Edit tour

Windows Analysis Report
hesaphareketi-015232024.SCR.exe

Overview

General Information

Sample name:	hesaphareketi-015232024.SCR.exe
Analysis ID:	1446506
MD5:	14f0b309c14c5f5e75c9a1d95967318b
SHA1:	baa09246339d936e19328dcca98c527a8af9cb5c
SHA256:	415dc24924ada536128e601b4372a72dd6d6e566e3b49c3c79a5b6dde7b702cf
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: RegAsm connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

hesaphareketi-015232024.SCR.exe (PID: 2444 cmdline: "C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe" MD5: 14F0B309C14C5F5E75C9A1D95967318B)

RegAsm.exe (PID: 2796 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "tqpas.com", "Username": "muratserbes@tqpas.com", "Password": "Ot939393!"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegAsm.exe PID: 2796	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 2796	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegAsm.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33525:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33597:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33621:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3378f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33825:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x338b5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31725:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31797:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31821:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x318b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3191d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3198f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31a25:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31ab5:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33525:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df55:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0xa8b95:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33597:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6dfc7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0xa8c07:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33621:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e051:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0xa8c91:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x336b3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0e3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0xa8d23:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x3371d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e14d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0xa8d8d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3378f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e1bf:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0xa8dff:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33825:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e255:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0xa8e95:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x176c05:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1b1635:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1ec275:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x176c77:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1b16a7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1ec2e7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x176d01:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1b1731:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1ec371:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x176d93:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1b17c3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1ec403:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x176dfd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1b182d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1ec46d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x176e6f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1b189f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1ec4df:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x176f05:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1b1935:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1ec575:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x12cfd5:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x167a05:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1a2645:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12d047:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x167a77:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x1a26b7:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x12d0d1:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x167b01:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1a2741:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12d163:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x167b93:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x1a27d3:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12d1cd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x167bfd:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x1a283d:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12d23f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x167c6f:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x1a28af:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12d2d5:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x167d05:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x1a2945:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B
Click to see the 10 entries

Sigma Signatures

Networking

Sigma detected: RegAsm connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DesusertionIp: 91.235.116.231, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe, Initiated: true, ProcessId: 2796, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49709

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 91.235.116.231, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: , Initiated: true, ProcessId: , Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49741

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: hesaphareketi-015232024.SCR.exe

Avira: detected

Found malware configuration

Source: 2.2.RegAsm.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "tqpas.com", "Username": "muratserbes@tqpas.com", "Password": "Ot939393!"}

Multi AV Scanner detection for submitted file

Source: hesaphareketi-015232024.SCR.exe	ReversingLabs: Detection: 39%
Source: hesaphareketi-015232024.SCR.exe	Virustotal: Detection: 44%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: hesaphareketi-015232024.SCR.exe

Joe Sandbox ML: detected

Source: hesaphareketi-015232024.SCR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49706 version: TLS 1.2

Source: hesaphareketi-015232024.SCR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\Users\GT350\source\repos\AtllasRunp\AtllasRunp\obj\Debug\Bienvenida.pdb source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273201762.0000000002611000.00000004.00000800.00020000.00000000.sdmp, hesaphareketi-015232024.SCR.exe, 00000000.00000002.1274573419.0000000004F10000.00000004.08000000.00040000.00000000.sdmp

Source: global traffic

TCP traffic: 192.168.2.9:49709 -> 91.235.116.231:587

Source: Joe Sandbox View	IP Address: 91.235.116.231 91.235.116.231
Source: Joe Sandbox View	IP Address: 91.235.116.231 91.235.116.231
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: THCPROJECTSRO THCPROJECTSRO

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.9:49709 -> 91.235.116.231:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: tqpas.com

Source: RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753167648.00000000091E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753167648.00000000091E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegAsm.exe, 00000002.00000002.3744691064.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002C43000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tqpas.com
Source: RegAsm.exe, 00000002.00000002.3748765410.0000000005D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748813573.0000000005DB1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753745047.0000000009263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3752707810.0000000009190000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753319677.00000000091F5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748878534.0000000005DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegAsm.exe, 00000002.00000002.3748765410.0000000005D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748813573.0000000005DB1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753745047.0000000009263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3752707810.0000000009190000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753319677.00000000091F5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748878534.0000000005DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.9:49706 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, gmBpn1ecBmQ.cs

.Net Code: CTkvi7Udc0s

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_36e5cc57-7

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00CC41C8	2_2_00CC41C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00CCE290	2_2_00CCE290
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00CCA950	2_2_00CCA950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00CC4A98	2_2_00CC4A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_00CC3E80	2_2_00CC3E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0640C268	2_2_0640C268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06407E70	2_2_06407E70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_064066E0	2_2_064066E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_064056B0	2_2_064056B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06402358	2_2_06402358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0640B328	2_2_0640B328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06400040	2_2_06400040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0640E498	2_2_0640E498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06405DF0	2_2_06405DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_06400025	2_2_06400025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 2_2_0640003C	2_2_0640003C

Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1271708067.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareGame.dll: vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4686de04-aad7-4ef3-a8cb-bdd3c6994f7d.exe4 vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273201762.0000000002611000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273201762.0000000002611000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename4686de04-aad7-4ef3-a8cb-bdd3c6994f7d.exe4 vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1274573419.0000000004F10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBienvenida.exe6 vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe, 00000000.00000002.1271292995.00000000006F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs hesaphareketi-015232024.SCR.exe
Source: hesaphareketi-015232024.SCR.exe	Binary or memory string: OriginalFilenameCheckGroup.exe6 vs hesaphareketi-015232024.SCR.exe

Source: hesaphareketi-015232024.SCR.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: hesaphareketi-015232024.SCR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.hesaphareketi-015232024.SCR.exe.4da0000.5.raw.unpack, Level.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack, Level.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack, Level.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, roEs93G.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, JQn0Aia1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, YsrmZ97b.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-015232024.SCR.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutant created: NULL

Source: hesaphareketi-015232024.SCR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: hesaphareketi-015232024.SCR.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegAsm.exe, 00000002.00000002.3748385053.0000000005CEA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: select * from Win32_OperatingSystem);

Source: hesaphareketi-015232024.SCR.exe	ReversingLabs: Detection: 39%
Source: hesaphareketi-015232024.SCR.exe	Virustotal: Detection: 44%

Source: unknown	Process created: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe "C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe"
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: hesaphareketi-015232024.SCR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: hesaphareketi-015232024.SCR.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Data Obfuscation

.NET source code contains potential unpacker

Source: hesaphareketi-015232024.SCR.exe, PluginTranslate.cs

.Net Code: LoadAndDecryptAssembly System.Reflection.Assembly.Load(byte[])

Source: hesaphareketi-015232024.SCR.exe

Static PE information: 0xA95F84AF [Sat Jan 17 23:56:31 2060 UTC]

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 2_2_00CC0C6D push edi; retf

2_2_00CC0C7A

Source: hesaphareketi-015232024.SCR.exe

Static PE information: section name: .text entropy: 7.9565006816864505

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Memory allocated: 2410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Memory allocated: 2610000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Memory allocated: 2410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 26E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199983	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198453	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 7280			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 2578			Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe TID: 1700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -99108s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98889s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98754s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98566s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -98109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97998s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97780s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97339s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96561s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96194s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -96093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199983s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1199109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1198999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1198890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1198781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1198671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1198562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7460	Thread sleep time: -1198453s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 99108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98754	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98566	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97998	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97339	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96561	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96194	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 96093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199983	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1199109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 1198453	Jump to behavior

Source: RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.hesaphareketi-015232024.SCR.exe.4f10000.6.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: MyGetProcAddress(hProcess, Name)
Source: 0.2.hesaphareketi-015232024.SCR.exe.4f10000.6.raw.unpack, QJDLGErGwGLnDsDTGnUfx.cs	Reference to suspicious API methods: LoadLibraryA(ref name)
Source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, eFaPC.cs	Reference to suspicious API methods: uegqtUwBmt.OpenProcess(zwYjuxQUnSG.DuplicateHandle, bInheritHandle: true, (uint)fAFQ.ProcessID)

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Queries volume information: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2796, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2796, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.37a6860.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.3663180.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.hesaphareketi-015232024.SCR.exe.36acdb0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: hesaphareketi-015232024.SCR.exe PID: 2444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 2796, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	11 Process Injection	1 Deobfuscate/Decode Files or Information	211 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	111 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	211 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	141 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
hesaphareketi-015232024.SCR.exe	39%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
hesaphareketi-015232024.SCR.exe	45%	Virustotal		Browse
hesaphareketi-015232024.SCR.exe	100%	Avira	HEUR/AGEN.1308640
hesaphareketi-015232024.SCR.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ipify.org	1%	Virustotal		Browse
tqpas.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://api.ipify.org/	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://api.ipify.org	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://tqpas.com	0%	Avira URL Cloud	safe
http://tqpas.com	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	172.67.74.152	true	false	1%, Virustotal, Browse	unknown
tqpas.com	91.235.116.231	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753167648.00000000091E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	hesaphareketi-015232024.SCR.exe, 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegAsm.exe, 00000002.00000002.3744691064.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	RegAsm.exe, 00000002.00000002.3748765410.0000000005D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748813573.0000000005DB1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753745047.0000000009263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3752707810.0000000009190000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753319677.00000000091F5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748878534.0000000005DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegAsm.exe, 00000002.00000002.3748765410.0000000005D9F000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748813573.0000000005DB1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753745047.0000000009263000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3752707810.0000000009190000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753319677.00000000091F5000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748878534.0000000005DC1000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F04000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tqpas.com	RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002C43000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002F0A000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://r3.i.lencr.org/0	RegAsm.exe, 00000002.00000002.3744691064.0000000002F5C000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000003027000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3753167648.00000000091E2000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002E27000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D29000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002BFE000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B5D000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743920591.0000000000FC9000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002CAD000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002D48000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743534682.0000000000F51000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748493743.0000000005D10000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002B75000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000F9B000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3743830230.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, RegAsm.exe, 00000002.00000002.3748385053.0000000005D00000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.235.116.231	tqpas.com	Romania		51177	THCPROJECTSRO	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446506
Start date and time:	2024-05-23 15:14:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	hesaphareketi-015232024.SCR.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@3/1@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 69 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:14:57	API Interceptor	10964138x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.235.116.231	Order Details89654.doc	Get hash	malicious	AgentTesla, zgRAT	Browse	rgkkzna.com/okc.exe
	RFQs.doc	Get hash	malicious	Unknown	Browse	rgkkzna.com/okc.exe
	http://www.expressfreightshippingcompany.com/	Get hash	malicious	Unknown	Browse	www.expressfreightshippingcompany.com/icons/icons.svg
	#Uc678#Ud654#Uc1a1#Uae08#Ud655#Uc778#Uc11cGLJ20210219.xlsx	Get hash	malicious	Unknown	Browse	lowes-ca.org/Img/AZZ.exe
	PROFORMA INVOICE.xlsx	Get hash	malicious	Unknown	Browse	lowes-ca.org/Img/VAI.exe
172.67.74.152	K8mzlntJVN.msi	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	stub.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Sonic-Glyder.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	SongOfVikings.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
tqpas.com	hesaphareketi-05222025.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	59c4c7e95c9549234661cc0c3a33de39958df413f3a408f3385e69fd669228fb_payload.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	hesaphareketi-01-5202024.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	hesaphareket_1715688000.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
api.ipify.org	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	ASCD0001 INQ9829......pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://t.co/COiSlB3Tom	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	Zam#U00f3w nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NEW ORDER.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	pro-forma invoice.xlsm.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	Order PS24S0040.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.74.152
	https://greettive-tke-783743.pages.dev/help/contact/95094729232531	Get hash	malicious	Unknown	Browse	104.26.12.205
	948209184.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	DHL Delivery Invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THCPROJECTSRO	hesaphareketi-05222025.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	59c4c7e95c9549234661cc0c3a33de39958df413f3a408f3385e69fd669228fb_payload.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	Aluminium_Oxide00980000.pdf.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	hesaphareketi-01-5202024.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	hesaphareket_1715688000.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	yTsIrrO40Q.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	rScanedP.O.pdf.exe	Get hash	malicious	AgentTesla	Browse	91.235.116.231
	rScaned_Product_Attached_Document.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	91.235.116.180
	rCompany_Profile.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	91.235.116.180
	DEKONT.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	91.235.116.180
CLOUDFLARENETUS	ORDEM DE COMPRA.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.97.3
	http://chocolatefashiononline.com	Get hash	malicious	Unknown	Browse	104.19.178.52
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	https://lnk.sk/mzoy	Get hash	malicious	Unknown	Browse	172.67.176.2
	https://lnk.sk/twr3	Get hash	malicious	Unknown	Browse	104.21.48.17
	COMMANDE.EXE.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.5.109
	t3h7DNer1Q.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	104.16.185.241
	https://docs.google.com/forms/d/e/1FAIpQLSeRYIPr_Xs8SxtWD9VaAhgsz9aibS_bijyTwdbidiIQ4ngVlQ/viewform?embedded=true&entry.1325074572=http%3A%2F%2Fr.smtp.euro-symbiose.fr%2Ftr%2Fcl%2Fqrjz6G3WMajAukEuXu-N0Qebu__8ljHwQjs84-vbNFkstMs8BrqGB6auM8cV52vdc-z8kda-O1XzLDMdp-o1VJ_xiAbOzr9v5pxwTGj0Dst_LdwxxKSPofjHdg7nt8IDlgUJ3uTEcfUBoqUeYZ1z6UfsaMJ-LJXtWMT4Mwb9atjObh_1JANJ5jvL-GurRI94WpyXTvnXhmqNG1ThqZzYQSaX5jfeHHDV6kb8kSgWbW5xuXgTilqIdc91eM30NL2GhrRlNADqergaHf7cyAh4WnSBK&entry.731640200=build-verify+URL%3A+build+UrlParams%3A+build-verify+URL%3A+get+URL%3A+decrypt%3A+base64+decode%3A+illegal+base64+data+at+input+byte+280	Get hash	malicious	Unknown	Browse	1.1.1.1
	RE Fasthosts - Payment Failed.eml	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.18.10.14
	https://url.uk.m.mimecastprotect.com/s/pk4ACO8rYSq23vcE1w2J	Get hash	malicious	Unknown	Browse	188.114.97.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	ORDEM DE COMPRA.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	rPurchaseOrderPO05232024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	ASCD0001 INQ9829......pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Invoice.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.74.152
	msimg32.dll	Get hash	malicious	Remcos	Browse	172.67.74.152
	https://url10.mailanyone.net/scanner?m=1s9Mri-0007hx-3T&d=4%7Cmail%2F90%2F1716287400%2F1s9Mri-0007hx-3T%7Cin10g%7C57e1b682%7C12862802%7C10019077%7C664C7952D245399BD4B163183C53C253&o=%2Fphte%3A%2Fdtsseedrontec.iuconsctomat%2Fku.&s=X3gWuPbJRU1Tmui7Qt2w30qEumE	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	INVOICE.js	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Zam#U00f3w nr 90016288247_ ZNG_1406_MG_2024_004782922.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	NEW ORDER.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	dfzesJIgdr.exe	Get hash	malicious	RedLine, Vidar	Browse	172.67.74.152

Process:	C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qpAE4KzecKDE4KhKiKhPKIE4oKNzKorE4j:MIHK5HKH1qHmAHKzecYHKh3oPtHo6THj
MD5:	1C6FD9CD428504CC2BA9F307F214A0D2
SHA1:	E07FC69DB2B137B7FF850BD7715B19FD14BBF7EF
SHA-256:	9364B7760F41CE9F4C3C0CB90578417011E3BB34D3F8565E74347E4EC5020E3A
SHA-512:	7ABF849B2905F7467B6CA1F5DA784199619ED52355253FE0490BC55100312D60FCCB9613B6AE0A762BB05813896057EE32AD0C60C2B2D5F24DB64F03272E293D
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\S

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.943263651555134
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	hesaphareketi-015232024.SCR.exe
File size:	329'216 bytes
MD5:	14f0b309c14c5f5e75c9a1d95967318b
SHA1:	baa09246339d936e19328dcca98c527a8af9cb5c
SHA256:	415dc24924ada536128e601b4372a72dd6d6e566e3b49c3c79a5b6dde7b702cf
SHA512:	7e8e8b92b9d3f55a105de154fdb1e468fa3e6bc73c21eef2495ba22ee0522e15dca490b1c1210b83ab2ed876f67c34efcde8ca72375a695ba69d9237ecaa5d30
SSDEEP:	6144:bJHFcDmiIr2baLQ+axLyAPuBthKaOUn1ajxPiFLUunarm5pL5Yzmwn3Wrgmi:hFKmX29+axg48gjxILLvpVE3tZ
TLSH:	9F64126A6768DB72C0B90BF7CE35C4860BA97A655222F2742BC5644A4CB3F395D3CF40
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....._...............0.................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x451a9e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xA95F84AF [Sat Jan 17 23:56:31 2060 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x51a44	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x5b6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4faa4	0x4fc00	d5109d32fe0d5a719fb6d6e3082bc2fa	False	0.9503024588557993	data	7.9565006816864505	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x52000	0x5b6	0x600	1819bf104364855a3cf8da27eef47702	False	0.419921875	data	4.108950182265055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x54000	0xc	0x200	407e18f88ad05f6ac5450625662c823d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x520a0	0x32c	data			0.42610837438423643
RT_MANIFEST	0x523cc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 15:14:57.248579979 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.248609066 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:57.248673916 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.257090092 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.257102966 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:57.741431952 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:57.741626024 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.758338928 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.758375883 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:57.758673906 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:57.812697887 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.844775915 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:57.886507034 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:58.068072081 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:58.068141937 CEST	443	49706	172.67.74.152	192.168.2.9
May 23, 2024 15:14:58.068815947 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:58.074317932 CEST	49706	443	192.168.2.9	172.67.74.152
May 23, 2024 15:14:58.794143915 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:14:58.844058990 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:14:58.844163895 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:14:59.752000093 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:14:59.752450943 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:14:59.757452965 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:14:59.971720934 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:14:59.973042965 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:14:59.978056908 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.227339983 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.227982998 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:00.232840061 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.455882072 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.457076073 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.457135916 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:00.460896015 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.460922003 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.460973978 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:00.492574930 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:00.512207985 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.512260914 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:00.521752119 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.763473988 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.766666889 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:00.771615982 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:00.999368906 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.000883102 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:01.006330967 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.220792055 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.221993923 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:01.271339893 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.516484976 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.516815901 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:01.526287079 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.782882929 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:01.783159971 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:01.789179087 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.103707075 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.103987932 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:02.113514900 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.327387094 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.328092098 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:02.329816103 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:02.329843998 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:02.329871893 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:15:02.333420992 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.343056917 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.343072891 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.343080044 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.696275949 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:15:02.750210047 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:28.852644920 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:28.857815027 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:16:29.072386026 CEST	587	49709	91.235.116.231	192.168.2.9
May 23, 2024 15:16:29.074644089 CEST	49709	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:29.075637102 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:29.128582954 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:29.128665924 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:29.851469994 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:29.851650953 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:29.856571913 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.069086075 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.069251060 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:30.074170113 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.288781881 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.289275885 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:30.294559002 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.516886950 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.519635916 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.519685984 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:30.523936033 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.527793884 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:30.576512098 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.790604115 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:30.791925907 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:30.798571110 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.182615042 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.182825089 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:31.191133976 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.404408932 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.404741049 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:31.409677029 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.695086956 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.695339918 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:31.701975107 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.914050102 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:31.914506912 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:31.919506073 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.227423906 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.227665901 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.232671976 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.445282936 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.446887970 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.446887970 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.446887970 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.446950912 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.450984001 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.451910973 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.452171087 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.456748009 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456763983 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456773996 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456784010 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456794024 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456801891 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456810951 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456820011 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456829071 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456836939 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456847906 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.456861019 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.456886053 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.456886053 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.456965923 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.464503050 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.466931105 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.469302893 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.469312906 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.469321012 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.470597982 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.474227905 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.474358082 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.485238075 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.485424042 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.493696928 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.494080067 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.498956919 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504354954 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504367113 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504374981 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504381895 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504390001 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504398108 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504405022 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.504411936 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.534971952 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:32.541765928 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.541774988 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.589566946 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.938824892 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:32.984895945 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:36.872489929 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:36.879971027 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:37.102113008 CEST	587	49716	91.235.116.231	192.168.2.9
May 23, 2024 15:16:37.102619886 CEST	49716	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:37.103617907 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:37.170574903 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:37.172580004 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:38.132740021 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:38.188363075 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:39.198159933 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:39.206578016 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.413265944 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.413748026 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:39.418637991 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.631014109 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.631560087 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:39.637479067 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.857234955 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.859330893 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.859726906 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:39.864075899 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:39.865425110 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:39.916538954 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.126240969 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.127196074 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:40.132148981 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.344257116 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.344568968 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:40.356708050 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.571281910 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.571624041 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:40.576591969 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.809839964 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:40.810409069 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:40.815408945 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:41.025701046 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:41.025897026 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:41.030771017 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:41.094831944 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:41.101228952 CEST	587	49717	91.235.116.231	192.168.2.9
May 23, 2024 15:16:41.101294041 CEST	49717	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:41.148035049 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:41.157337904 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:41.157412052 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:42.075617075 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.075930119 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:42.081026077 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.292871952 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.295022964 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:42.308305025 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.523263931 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.526449919 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:42.531454086 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.751427889 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.752932072 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.753032923 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:42.756457090 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:42.757812977 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:42.809101105 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.023374081 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.024621964 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:43.029515028 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.239968061 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.240423918 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:43.245399952 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.456191063 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.456509113 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:43.461466074 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.684943914 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.685178995 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:43.690411091 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.900542021 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:43.900810003 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:43.905675888 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.211380959 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.212969065 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.219213963 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.447284937 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.450942039 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.451010942 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.451011896 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.451080084 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.453319073 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.455944061 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.458852053 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.460726976 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460736036 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460746050 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460753918 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460761070 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460768938 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460776091 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460783958 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460792065 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460799932 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460807085 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.460820913 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.460863113 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.460875034 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.465488911 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.467191935 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.470241070 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.470249891 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.470257998 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.470266104 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.470273018 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.470313072 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.470438957 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.474997997 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.478959084 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.479892969 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.479902029 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.479908943 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.479917049 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.480132103 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:16:44.484651089 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.484658957 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.484667063 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489459991 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489469051 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489475965 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489484072 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489491940 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489499092 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489506006 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489510059 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.489516020 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.539303064 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.539313078 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:44.935548067 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:16:45.057251930 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:13.054725885 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:13.139282942 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:17:13.420548916 CEST	587	49718	91.235.116.231	192.168.2.9
May 23, 2024 15:17:13.421047926 CEST	49718	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:13.422553062 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:13.474632978 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:13.476394892 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:14.286801100 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.286973953 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:14.292053938 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.504234076 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.504420042 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:14.509752989 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.724899054 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.726511002 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:14.731534958 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.956543922 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.958554029 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.963062048 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:14.963289976 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:14.971036911 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:15.022746086 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:15.082228899 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:15.088236094 CEST	587	49719	91.235.116.231	192.168.2.9
May 23, 2024 15:17:15.093287945 CEST	49719	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:15.133066893 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:15.146339893 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:15.153040886 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.085582972 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.085726023 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.090712070 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.304831982 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.304975986 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.312268019 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.526599884 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.527076006 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.532928944 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.757102013 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.758198023 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.758256912 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.761794090 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.763679028 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.797724009 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.927067041 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.950402975 CEST	587	49720	91.235.116.231	192.168.2.9
May 23, 2024 15:17:16.950511932 CEST	49720	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:16.976780891 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:17.006433010 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:17.006747961 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:17.820373058 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:17.826422930 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:17.831568003 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.043673038 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.043812990 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.048963070 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.271934032 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.272507906 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.279678106 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.503616095 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.504795074 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.504870892 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.508348942 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.508373976 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.508414030 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.510679007 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.555382013 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.555432081 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.560187101 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.769059896 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.770503044 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:18.779848099 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.994810104 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:18.995316982 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:19.000472069 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.213536978 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.216540098 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:19.221551895 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.448738098 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.449028015 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:19.501580000 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.668195963 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.669395924 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:19.674420118 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.982673883 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:19.982917070 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:19.989340067 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.200493097 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.200875044 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.200953960 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.200953960 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.201041937 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.202547073 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.214757919 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214788914 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214807034 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.214817047 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214845896 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214874029 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214895010 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.214919090 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214921951 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.214946985 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214970112 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.214976072 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.214998007 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.215003967 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.215023041 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.215037107 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.215049982 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.215050936 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.215084076 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.215101957 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.215133905 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.220510960 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.220570087 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.225524902 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.225553989 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.225581884 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.225593090 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.225609064 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.225611925 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.225636959 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.225692034 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.232229948 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.232283115 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.241797924 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.241827965 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.241853952 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.241854906 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.241883039 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.241890907 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.241909981 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.241911888 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.241936922 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.241964102 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.248507977 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.248537064 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.254879951 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.254908085 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.254935026 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.254961014 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.254987955 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255013943 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255040884 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255068064 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255095005 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255121946 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255135059 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255161047 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255187035 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255213022 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255239964 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255266905 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255292892 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.255321026 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.297535896 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:20.302706957 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.302752018 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.353589058 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.704621077 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:20.750839949 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:27.438632011 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:27.444077969 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:27.677556992 CEST	587	49721	91.235.116.231	192.168.2.9
May 23, 2024 15:17:27.681899071 CEST	49721	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:27.685146093 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:27.691762924 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:27.692049980 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:28.480262041 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:28.480480909 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:28.485909939 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:28.739450932 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:28.782319069 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:29.943500042 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:29.948620081 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.158343077 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.158822060 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.163778067 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.381536961 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.383599997 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.383646965 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.388421059 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.388438940 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.388492107 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.390137911 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.435590029 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.435645103 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.441921949 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.657948017 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.659071922 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.664069891 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.963479996 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:30.963752031 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:30.968791008 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:31.186745882 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:31.187367916 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:31.248806000 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:31.455537081 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:31.456094980 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:31.467947960 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:31.693280935 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:31.693470955 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:31.699080944 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.009603024 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.009855986 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.018536091 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.236145020 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.236613989 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.236689091 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.236749887 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.236869097 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.238837957 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.241640091 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.241698027 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246416092 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246450901 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246500969 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246531010 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246545076 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246558905 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246578932 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246586084 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246620893 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246628046 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246638060 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246655941 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246658087 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246684074 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246690035 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246701002 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246711016 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.246723890 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.246758938 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.251265049 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.251318932 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256454945 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256500959 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256500959 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256529093 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256540060 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256556034 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256571054 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256582975 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256608009 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256609917 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256623983 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256635904 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256659985 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256663084 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256690025 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256690025 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256716967 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.256721973 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256773949 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.256789923 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.261791945 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.261846066 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.266601086 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266645908 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266657114 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.266674042 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266701937 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266712904 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:32.266727924 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266756058 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266782999 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266813993 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266820908 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266848087 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266875029 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266906023 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266912937 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266940117 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266967058 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.266993046 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.267019987 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.267046928 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.267074108 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.271308899 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.271338940 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.271365881 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.271406889 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276067019 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276098013 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276128054 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276154995 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276180983 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276210070 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276237011 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276263952 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.276292086 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.323398113 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.725547075 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:32.875812054 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.317687035 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.323460102 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:35.536700010 CEST	587	49722	91.235.116.231	192.168.2.9
May 23, 2024 15:17:35.539495945 CEST	49722	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.542543888 CEST	49723	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.596585035 CEST	587	49723	91.235.116.231	192.168.2.9
May 23, 2024 15:17:35.598629951 CEST	49723	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.688405991 CEST	49723	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.693617105 CEST	587	49723	91.235.116.231	192.168.2.9
May 23, 2024 15:17:35.699239016 CEST	49723	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.765583038 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:35.770798922 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:35.773426056 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:36.495038986 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:36.495212078 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:36.500281096 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:36.711803913 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:36.711930037 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:36.716814041 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:36.939527988 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:36.956351995 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:36.961261988 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.180833101 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.182904005 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.183223009 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.187519073 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.187527895 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.187638998 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.191112041 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.238065958 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.238503933 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.248416901 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.481337070 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.495102882 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.501130104 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.710623980 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.711399078 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.716511011 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.926611900 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:37.927365065 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:37.935126066 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.216041088 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.216286898 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.221358061 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.431799889 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.431998014 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.437027931 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.742063999 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.742505074 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.748476982 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.957648993 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.961739063 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.961904049 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.961941004 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.961941004 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.965914011 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.966923952 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.967127085 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.971698999 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971713066 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971725941 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971729994 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971739054 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971744061 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971754074 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.971893072 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.972002983 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.977240086 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.977271080 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.977303028 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.977315903 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.977329969 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.977448940 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.982913971 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.982929945 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.982942104 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.982953072 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.982994080 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.983083010 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.987629890 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.987643957 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.987670898 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.987765074 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.987765074 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.992405891 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.992420912 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.992435932 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.992440939 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.992454052 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.992459059 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.992511988 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.992562056 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:38.997622967 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.997641087 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:38.997782946 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:39.002449036 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002455950 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002470016 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002475977 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002499104 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002504110 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002516985 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002521992 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002535105 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.002600908 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:39.007230997 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007236958 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007250071 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007256031 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007268906 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007273912 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007287025 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007292986 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.007306099 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012461901 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012469053 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012481928 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012486935 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012500048 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012506008 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.012517929 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.063359976 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.464674950 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:39.516366005 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:44.523118019 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:44.528431892 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:44.739140034 CEST	587	49724	91.235.116.231	192.168.2.9
May 23, 2024 15:17:44.740566015 CEST	49724	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:44.740566015 CEST	49725	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:44.796458006 CEST	587	49725	91.235.116.231	192.168.2.9
May 23, 2024 15:17:44.797245026 CEST	49725	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:45.693214893 CEST	587	49725	91.235.116.231	192.168.2.9
May 23, 2024 15:17:45.693375111 CEST	49725	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:45.699161053 CEST	587	49725	91.235.116.231	192.168.2.9
May 23, 2024 15:17:45.735500097 CEST	49725	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:45.773121119 CEST	587	49725	91.235.116.231	192.168.2.9
May 23, 2024 15:17:45.773312092 CEST	49725	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:45.792592049 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:45.820476055 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:45.820727110 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:46.639533997 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:46.643246889 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:46.648269892 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:46.860116005 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:46.860651016 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:46.865595102 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.098895073 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.099411011 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.104888916 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.326628923 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.327758074 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.327904940 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.332556963 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.332576990 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.332633018 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.334305048 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.379348040 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.379642963 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.384805918 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.594754934 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.598270893 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.603286982 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.815251112 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:47.815987110 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:47.821100950 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.034210920 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.038768053 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:48.044357061 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.272483110 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.276035070 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:48.281002998 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.492938042 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.495322943 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:48.500628948 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.806677103 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:48.811335087 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:48.816384077 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.028259039 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.028666973 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.028666973 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.028804064 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.028804064 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.030020952 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.033888102 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.034059048 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.038796902 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038805962 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038813114 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038820028 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038822889 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038830042 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038836956 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038842916 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038858891 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038868904 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038871050 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.038876057 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.038907051 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.044078112 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.044130087 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.048791885 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048805952 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048815012 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048823118 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048830032 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048839092 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048846006 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048851013 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.048856020 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.048881054 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.048927069 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.054229021 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.054281950 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.059247971 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059257984 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059267044 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059276104 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059283018 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059290886 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059298038 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059307098 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059314013 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.059314966 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059324980 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059328079 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.059334993 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059345007 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059353113 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.059360981 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064625025 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064635038 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064644098 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064651966 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064660072 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064667940 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064677000 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064685106 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064693928 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.064702034 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.094506025 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:49.111283064 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111293077 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111301899 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111310005 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111319065 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111325979 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111335039 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111341953 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111350060 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.111357927 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.116652012 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.670876980 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:49.719508886 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:56.334971905 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:56.340039968 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:56.552647114 CEST	587	49726	91.235.116.231	192.168.2.9
May 23, 2024 15:17:56.553059101 CEST	49726	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:56.554902077 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:56.608405113 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:56.608506918 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:57.316495895 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:57.316688061 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:57.321695089 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:57.536776066 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:57.537050009 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:57.542810917 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:57.758707047 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:57.759057999 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:57.788667917 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.016475916 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.016540051 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.016654015 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:58.018177986 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.020268917 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:58.045907974 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.045964003 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:58.050045013 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.255465984 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.257100105 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:58.320724010 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.550338984 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.550580025 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:58.555464983 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.770976067 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:58.771476984 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:58.776525021 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.002145052 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.002410889 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.009493113 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.221846104 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.222044945 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.226984978 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.540462971 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.540647984 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.548326969 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.760998011 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.761280060 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.761313915 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.761352062 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.761396885 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.763813019 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.766220093 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.766274929 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.771007061 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771023035 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771028042 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771030903 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771035910 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771039963 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771044016 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771047115 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771056890 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771061897 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771080971 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.771217108 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.771264076 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.775806904 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.775873899 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.780574083 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780587912 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780599117 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780610085 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780620098 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780632019 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.780639887 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780651093 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780661106 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.780673981 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.780730963 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.785384893 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.785465956 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.790404081 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.790417910 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.790432930 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.790442944 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.790452003 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.790502071 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.790535927 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.795175076 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.795233011 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.800028086 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800040960 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800050974 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800060987 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800070047 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800077915 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.800079107 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800090075 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800101995 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800111055 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800122023 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800122976 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:17:59.800132990 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800143957 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800153971 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800158978 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.800168991 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.804826021 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.804837942 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.804847956 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809595108 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809606075 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809614897 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809626102 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809636116 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809652090 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.809663057 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:17:59.824774981 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:18:00.263607979 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:18:00.313296080 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:04.692835093 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:04.706464052 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:18:04.924186945 CEST	587	49727	91.235.116.231	192.168.2.9
May 23, 2024 15:18:04.927720070 CEST	49727	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:04.928807020 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:04.986552000 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:04.987375975 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:05.679956913 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:05.690562010 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:05.743496895 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:05.904064894 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:05.904285908 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:05.911348104 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.201564074 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.202079058 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:06.220803022 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.424706936 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.425910950 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.426018000 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:06.430692911 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.430713892 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.430794001 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:06.432596922 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:06.441284895 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.650557995 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.653583050 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:06.658668995 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.883935928 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:06.884166002 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:06.889106035 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.098901987 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.099526882 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:07.105330944 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.327553988 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.329549074 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:07.334496021 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.543116093 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.547199011 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:07.552275896 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.855258942 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:07.855600119 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:07.860816002 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.070126057 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.070507050 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.070590019 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.070628881 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.070688009 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.072201014 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.075486898 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.075566053 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.080806971 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080821037 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080847025 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080861092 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080873966 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080885887 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080890894 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.080899954 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080909967 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.080914021 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080934048 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080935955 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.080949068 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.080960989 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.080962896 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.081006050 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.081022978 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.085758924 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.085815907 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.094235897 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.094244003 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.094268084 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.094280958 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.094290972 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.094295979 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.094306946 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.094310999 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.094338894 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.094358921 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.102562904 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.102612972 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.110923052 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.111011028 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.115735054 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.115801096 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.120656967 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120678902 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120687962 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120697975 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120702982 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.120708942 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120719910 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120719910 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.120731115 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120740891 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120743036 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.120750904 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120767117 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120773077 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120778084 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120784998 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120789051 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120790005 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.120791912 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:08.125581980 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.125600100 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130342007 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130362988 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130388021 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130398035 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130409002 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130413055 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130423069 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.130433083 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.176140070 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.553617954 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:08.594559908 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:16.637866020 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:16.642857075 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:16.852197886 CEST	587	49728	91.235.116.231	192.168.2.9
May 23, 2024 15:18:16.852715015 CEST	49728	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:16.853840113 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:16.864691973 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:16.866524935 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:17.671801090 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:17.674505949 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:17.679449081 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:17.894972086 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:17.899396896 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:17.904365063 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:18.117125034 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:18.117640018 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:18.125490904 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:18.333128929 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:18.340662003 CEST	587	49729	91.235.116.231	192.168.2.9
May 23, 2024 15:18:18.340790987 CEST	49729	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:18.403424978 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:18.408466101 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:18.408538103 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.103773117 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.104410887 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.112314939 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.322977066 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.323338985 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.328661919 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.540342093 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.540999889 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.545856953 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.765204906 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.766088963 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.766293049 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.769864082 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.769876957 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.770041943 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.774497032 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.816476107 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:19.816593885 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:19.822837114 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.026793957 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.029238939 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:20.034198046 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.244076967 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.246491909 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:20.251380920 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.461807966 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.462084055 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:20.467009068 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.692449093 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.692728996 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:20.697868109 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.920506954 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:20.920721054 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:20.930269003 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.233481884 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.234502077 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.239362001 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.449070930 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.449486971 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.449487925 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.449487925 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.449867964 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.450838089 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.454370022 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.454509020 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.465065002 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465078115 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465086937 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465095043 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465102911 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465111971 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465120077 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465127945 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465135098 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465143919 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465152025 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465161085 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.465169907 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.465169907 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.465218067 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.470093966 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.471339941 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.474862099 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.474874020 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.474881887 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.475048065 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.479599953 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.483309031 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.484399080 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.484407902 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.484415054 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.484422922 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.484430075 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.484437943 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.484668970 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:21.489362001 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494148970 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494160891 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494168997 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494178057 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494185925 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494199991 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494204998 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494210005 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494214058 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494218111 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494221926 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494225979 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494229078 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.494230032 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.543361902 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:21.936580896 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:22.001317024 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:22.093241930 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:22.104407072 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:22.315764904 CEST	587	49730	91.235.116.231	192.168.2.9
May 23, 2024 15:18:22.316224098 CEST	49730	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:22.317195892 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:22.368546009 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:22.370213032 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.058960915 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.059106112 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.064088106 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.273788929 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.273957968 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.336966991 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.500736952 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.501204967 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.513324022 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.548466921 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.554775953 CEST	587	49731	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.554944038 CEST	49731	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.598992109 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:23.608948946 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:23.609016895 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:24.314575911 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.314740896 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:24.321400881 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.533696890 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.539310932 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:24.551513910 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.758078098 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.758464098 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:24.769176006 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.990606070 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.992398024 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:24.992476940 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:24.995925903 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.026238918 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:25.076925993 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.290736914 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.292288065 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:25.297235966 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.532701015 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.532880068 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:25.550594091 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.767348051 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:25.770508051 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:25.775489092 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.004159927 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.004404068 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.063967943 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.227565050 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.230681896 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.242129087 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.545728922 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.546509981 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.551449060 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.765717030 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.766102076 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.766156912 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.766227007 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.766307116 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.767752886 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.770992994 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.771064997 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.780601025 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780613899 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780622959 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780631065 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780637980 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780647039 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780654907 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780663013 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780670881 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780673981 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.780679941 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780688047 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780695915 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.780714035 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.780730009 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.780761003 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.785597086 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.785660028 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.790373087 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790384054 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790393114 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790401936 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790410042 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790419102 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790427923 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790431976 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.790435076 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790443897 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.790446043 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.790457964 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.790509939 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.790534019 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.795172930 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.795219898 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.800848007 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800857067 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800867081 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800875902 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800883055 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800890923 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800899982 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800908089 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800910950 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:26.800915956 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800924063 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800931931 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800939083 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800946951 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800954103 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800957918 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800966024 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.800973892 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805843115 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805850983 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805859089 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805866957 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805875063 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805881977 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805891037 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805898905 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805907965 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.805915117 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851412058 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851424932 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851433992 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851442099 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851449013 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851453066 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:26.851459980 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:27.256424904 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:27.391526937 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:28.258375883 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:28.263453007 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:28.476402998 CEST	587	49732	91.235.116.231	192.168.2.9
May 23, 2024 15:18:28.477076054 CEST	49732	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:28.478065014 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:28.532656908 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:28.533305883 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:29.260885954 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.261014938 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:29.265878916 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.479856014 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.482773066 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:29.487749100 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.707688093 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.725824118 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:29.732475042 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.962495089 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.963978052 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.964288950 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:29.967483044 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:29.969007015 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:30.020440102 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.270045996 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.271958113 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:30.277721882 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.491390944 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.494205952 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:30.499118090 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.713661909 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.714775085 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:30.720151901 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.946876049 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:30.947191000 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:30.953028917 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:31.167007923 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:31.167398930 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:31.172370911 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:31.220257044 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:31.225687027 CEST	587	49733	91.235.116.231	192.168.2.9
May 23, 2024 15:18:31.231313944 CEST	49733	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:31.274744034 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:31.288615942 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:31.288754940 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:31.979995966 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:31.981520891 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:31.987402916 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.196613073 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.202512026 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:32.207431078 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.416918039 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.417727947 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:32.422715902 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.643260956 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.643273115 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.643337011 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:32.649419069 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.651308060 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:32.700895071 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.909548998 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:32.911546946 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:32.916883945 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.125047922 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.126020908 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:33.131052017 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.383910894 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.387090921 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:33.392054081 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.615509987 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.636437893 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:33.642136097 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.849679947 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:33.854502916 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:33.859391928 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.164141893 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.167027950 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.175712109 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.383289099 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.383785963 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.387913942 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.387913942 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.388016939 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.394855976 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.399799109 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.399832010 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.399844885 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.399857044 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.399869919 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.399903059 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.404536963 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404551029 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404562950 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404573917 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404586077 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404597998 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.404597998 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404611111 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404622078 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.404623985 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.404640913 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.404654980 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.404670954 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.410008907 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.410022020 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.410103083 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.415853977 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.415873051 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.415884972 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.415896893 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.415908098 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.415919065 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.415955067 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.415987968 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.415987968 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.416021109 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.416039944 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.421427965 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.421458006 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.421528101 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.421552896 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.427377939 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427390099 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427402020 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427428961 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427442074 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427453041 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427453995 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:34.427464962 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427490950 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427525043 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427552938 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427565098 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427577019 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427603006 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427614927 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427625895 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427651882 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427664042 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427689075 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.427701950 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432710886 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432723999 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432750940 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432763100 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432789087 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432800055 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432811975 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.432821989 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.437459946 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.437469006 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.437479019 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:34.487350941 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:35.768666029 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:35.768666029 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:35.770524025 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:35.788156033 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:35.793160915 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:35.844274998 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:36.119699955 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:36.204090118 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:40.887067080 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:40.932818890 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:41.147454977 CEST	587	49734	91.235.116.231	192.168.2.9
May 23, 2024 15:18:41.148045063 CEST	49734	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:41.149182081 CEST	49735	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:41.161654949 CEST	587	49735	91.235.116.231	192.168.2.9
May 23, 2024 15:18:41.161782026 CEST	49735	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:41.190519094 CEST	49735	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:41.261864901 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:41.267086029 CEST	587	49735	91.235.116.231	192.168.2.9
May 23, 2024 15:18:41.267172098 CEST	49735	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:41.272042036 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:41.272133112 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:42.066909075 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.067172050 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:42.072113037 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.280462980 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.282512903 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:42.290785074 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.500741959 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.503245115 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:42.508373022 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.727252960 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.728200912 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.729923964 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:42.732959986 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.734132051 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:42.739963055 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.995275021 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:42.997541904 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:43.047286034 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.213165045 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.213355064 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:43.240835905 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.440021038 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.440277100 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:43.445169926 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.704391956 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:43.709712982 CEST	587	49736	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.711292982 CEST	49736	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:43.781579018 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:43.786564112 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:43.786808968 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:44.506469011 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:44.506628990 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:44.511708975 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:44.723767042 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:44.724061966 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:44.729022980 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:44.942347050 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:44.942838907 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:44.947776079 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.169775009 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.170335054 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.174527884 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.174535990 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.174565077 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.174772024 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.179301023 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.195724010 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.198879004 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.200617075 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.421428919 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.428451061 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.433377028 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.645473957 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.656603098 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.661523104 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.875498056 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:45.877837896 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:45.882785082 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.119569063 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.119887114 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.124808073 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.336838007 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.337040901 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.395505905 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.654341936 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.654905081 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.660206079 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.876117945 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.876471996 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.876544952 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.876594067 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.876683950 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.877851009 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.883316994 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.883426905 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.889698982 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889714003 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889723063 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889733076 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889741898 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889750004 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889759064 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889766932 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889775991 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889784098 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889796972 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.889800072 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.889800072 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.889834881 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.889847994 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.896312952 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.896362066 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.906429052 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.906439066 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.906449080 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.906456947 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.906471968 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.906502008 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.906532049 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.906568050 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.906588078 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.913098097 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.913249016 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.920831919 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.920854092 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.920861959 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.920869112 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.920880079 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.920900106 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.920943975 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.928193092 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.928257942 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.939496994 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.939507008 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.939541101 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.939578056 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:46.944411039 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.944422007 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.944432974 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.950166941 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.950191021 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.950201035 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:46.950212002 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.003359079 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.003371954 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.003395081 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.003405094 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.003412008 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.373871088 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.501029968 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:47.593532085 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:47.598788023 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.812776089 CEST	587	49737	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.815716982 CEST	49737	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:47.819351912 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:47.869535923 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:47.871470928 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:48.561564922 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:48.561741114 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:48.566961050 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:48.778038979 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:48.778230906 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:48.784959078 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:48.994195938 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:48.994923115 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:48.999789000 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.218230009 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.219672918 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.219831944 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.222989082 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.223023891 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.223258972 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.224451065 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.271459103 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.276369095 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.276456118 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.485584974 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.490725994 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.495703936 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.705086946 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.706504107 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.714869022 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.831367970 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.841346025 CEST	587	49738	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.841427088 CEST	49738	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.899445057 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:49.904691935 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:49.904910088 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:50.595005035 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:50.637212992 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:50.642272949 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:50.850665092 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:50.850826025 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:50.855772018 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.065519094 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.065886974 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.070771933 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.288557053 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.290677071 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.293366909 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.295448065 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.295461893 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.297621012 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.298975945 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.343343973 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.347282887 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.348239899 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.556689978 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.610512018 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.618292093 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.661058903 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.869688034 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:51.870207071 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:51.880661964 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:56.109071016 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:56.109359980 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:56.114290953 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:56.173443079 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:56.181420088 CEST	587	49739	91.235.116.231	192.168.2.9
May 23, 2024 15:18:56.181466103 CEST	49739	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:56.246954918 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:56.252499104 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:56.252576113 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:56.971597910 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:56.971875906 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:57.029963970 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.187041044 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.190510988 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:57.195390940 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.407329082 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.408018112 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:57.412990093 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.652769089 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.654597044 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.655275106 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:57.659957886 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.663276911 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:57.708724976 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.931823015 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:57.933701038 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:57.975183010 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.157196045 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.159816980 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:58.164712906 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.380626917 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.380908966 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:58.394320011 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.619874001 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.620110035 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:58.627257109 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.837316036 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:58.837508917 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.205873013 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.205902100 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.213799000 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.215509892 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.220771074 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.271321058 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.433784008 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.434973955 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.435070038 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.435128927 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.435128927 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.439323902 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.444144011 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.444205046 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.456317902 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456335068 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456348896 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456357002 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456367016 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456374884 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456382990 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456389904 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456393003 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456399918 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456432104 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.456434011 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456432104 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.456443071 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.456468105 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.456527948 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.461049080 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.461113930 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.465830088 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465837955 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465845108 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465850115 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465854883 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465859890 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465866089 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465871096 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.465878963 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.465956926 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.470629930 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.471322060 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.475404024 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475419998 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475428104 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475436926 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475445986 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475454092 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475476980 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.475485086 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475493908 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.475524902 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.475550890 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.480488062 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.480503082 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.480608940 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.485394001 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485409975 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485418081 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485426903 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485434055 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485443115 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485451937 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485459089 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485466957 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485476017 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485482931 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485488892 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:18:59.485491037 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485500097 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485507965 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485516071 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.485522985 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.490272999 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.490286112 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.490293026 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.490302086 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.495131016 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.495143890 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.495151043 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.495160103 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.547359943 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:18:59.928466082 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:19:00.110349894 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:05.345266104 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:05.355146885 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:19:05.585599899 CEST	587	49740	91.235.116.231	192.168.2.9
May 23, 2024 15:19:05.586544037 CEST	49740	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:05.586544037 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:05.636606932 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:05.639293909 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:06.341356993 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:06.341530085 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:06.346558094 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:06.559581041 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:06.559787035 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:06.567593098 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:06.778594971 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:06.778983116 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:06.784420013 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.003405094 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.005315065 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.005371094 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.009717941 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.009726048 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.009773970 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.011440039 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.056150913 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.056327105 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.061022997 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.271254063 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.274141073 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.282596111 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.490597963 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.491034985 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.496680975 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.706546068 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.706849098 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.713359118 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.939361095 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:07.941164017 CEST	49741	587	192.168.2.9	91.235.116.231
May 23, 2024 15:19:07.949532986 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:08.156622887 CEST	587	49741	91.235.116.231	192.168.2.9
May 23, 2024 15:19:08.204132080 CEST	49741	587	192.168.2.9	91.235.116.231

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 15:14:57.230475903 CEST	57586	53	192.168.2.9	1.1.1.1
May 23, 2024 15:14:57.243927002 CEST	53	57586	1.1.1.1	192.168.2.9
May 23, 2024 15:14:58.749483109 CEST	52999	53	192.168.2.9	1.1.1.1
May 23, 2024 15:14:58.793510914 CEST	53	52999	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 15:14:57.230475903 CEST	192.168.2.9	1.1.1.1	0xa1b7	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:58.749483109 CEST	192.168.2.9	1.1.1.1	0xb9b2	Standard query (0)	tqpas.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 23, 2024 15:14:57.243927002 CEST	1.1.1.1	192.168.2.9	0xa1b7	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:57.243927002 CEST	1.1.1.1	192.168.2.9	0xa1b7	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:57.243927002 CEST	1.1.1.1	192.168.2.9	0xa1b7	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
May 23, 2024 15:14:58.793510914 CEST	1.1.1.1	192.168.2.9	0xb9b2	No error (0)	tqpas.com	91.235.116.231	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	172.67.74.152	443	2796	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 13:14:57 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-05-23 13:14:58 UTC	211	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 13:14:57 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 88854fdfdc380f85-EWR
2024-05-23 13:14:58 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 37 35 Data Ascii: 8.46.123.175

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 23, 2024 15:14:59.752000093 CEST	587	49709	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:14:59 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:14:59.752450943 CEST	49709	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:14:59.971720934 CEST	587	49709	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:14:59.973042965 CEST	49709	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:15:00.227339983 CEST	587	49709	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:16:29.851469994 CEST	587	49716	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:16:29 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:16:29.851650953 CEST	49716	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:16:30.069086075 CEST	587	49716	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:16:30.069251060 CEST	49716	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:16:30.288781881 CEST	587	49716	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:16:38.132740021 CEST	587	49717	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:16:38 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:16:39.198159933 CEST	49717	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:16:39.413265944 CEST	587	49717	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:16:39.413748026 CEST	49717	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:16:39.631014109 CEST	587	49717	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:16:42.075617075 CEST	587	49718	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:16:41 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:16:42.075930119 CEST	49718	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:16:42.292871952 CEST	587	49718	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:16:42.295022964 CEST	49718	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:16:42.523263931 CEST	587	49718	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:14.286801100 CEST	587	49719	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:14 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:14.286973953 CEST	49719	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:14.504234076 CEST	587	49719	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:14.504420042 CEST	49719	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:14.724899054 CEST	587	49719	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:16.085582972 CEST	587	49720	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:15 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:16.085726023 CEST	49720	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:16.304831982 CEST	587	49720	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:16.304975986 CEST	49720	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:16.526599884 CEST	587	49720	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:17.820373058 CEST	587	49721	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:17 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:17.826422930 CEST	49721	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:18.043673038 CEST	587	49721	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:18.043812990 CEST	49721	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:18.271934032 CEST	587	49721	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:28.480262041 CEST	587	49722	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:28 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:28.480480909 CEST	49722	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:28.739450932 CEST	587	49722	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:29.943500042 CEST	49722	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:30.158343077 CEST	587	49722	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:36.495038986 CEST	587	49724	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:36 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:36.495212078 CEST	49724	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:36.711803913 CEST	587	49724	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:36.711930037 CEST	49724	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:36.939527988 CEST	587	49724	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:45.693214893 CEST	587	49725	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:45 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:45.693375111 CEST	49725	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:46.639533997 CEST	587	49726	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:46 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:46.643246889 CEST	49726	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:46.860116005 CEST	587	49726	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:46.860651016 CEST	49726	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:47.098895073 CEST	587	49726	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:17:57.316495895 CEST	587	49727	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:17:57 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:17:57.316688061 CEST	49727	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:17:57.536776066 CEST	587	49727	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:17:57.537050009 CEST	49727	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:17:57.758707047 CEST	587	49727	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:05.679956913 CEST	587	49728	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:05 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:05.690562010 CEST	49728	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:05.904064894 CEST	587	49728	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:05.904285908 CEST	49728	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:06.201564074 CEST	587	49728	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:17.671801090 CEST	587	49729	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:17 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:17.674505949 CEST	49729	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:17.894972086 CEST	587	49729	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:17.899396896 CEST	49729	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:18.117125034 CEST	587	49729	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:19.103773117 CEST	587	49730	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:18 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:19.104410887 CEST	49730	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:19.322977066 CEST	587	49730	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:19.323338985 CEST	49730	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:19.540342093 CEST	587	49730	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:23.058960915 CEST	587	49731	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:22 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:23.059106112 CEST	49731	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:23.273788929 CEST	587	49731	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:23.273957968 CEST	49731	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:23.500736952 CEST	587	49731	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:24.314575911 CEST	587	49732	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:24 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:24.314740896 CEST	49732	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:24.533696890 CEST	587	49732	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:24.539310932 CEST	49732	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:24.758078098 CEST	587	49732	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:29.260885954 CEST	587	49733	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:29 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:29.261014938 CEST	49733	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:29.479856014 CEST	587	49733	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:29.482773066 CEST	49733	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:29.707688093 CEST	587	49733	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:31.979995966 CEST	587	49734	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:31 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:31.981520891 CEST	49734	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:32.196613073 CEST	587	49734	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:32.202512026 CEST	49734	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:32.416918039 CEST	587	49734	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:42.066909075 CEST	587	49736	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:41 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:42.067172050 CEST	49736	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:42.280462980 CEST	587	49736	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:42.282512903 CEST	49736	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:42.500741959 CEST	587	49736	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:44.506469011 CEST	587	49737	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:44 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:44.506628990 CEST	49737	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:44.723767042 CEST	587	49737	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:44.724061966 CEST	49737	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:44.942347050 CEST	587	49737	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:48.561564922 CEST	587	49738	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:48 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:48.561741114 CEST	49738	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:48.778038979 CEST	587	49738	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:48.778230906 CEST	49738	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:48.994195938 CEST	587	49738	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:50.595005035 CEST	587	49739	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:50 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:50.637212992 CEST	49739	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:50.850665092 CEST	587	49739	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:50.850826025 CEST	49739	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:51.065519094 CEST	587	49739	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:18:56.971597910 CEST	587	49740	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:18:56 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:18:56.971875906 CEST	49740	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:18:57.187041044 CEST	587	49740	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:18:57.190510988 CEST	49740	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:18:57.407329082 CEST	587	49740	91.235.116.231	192.168.2.9	220 TLS go ahead
May 23, 2024 15:19:06.341356993 CEST	587	49741	91.235.116.231	192.168.2.9	220-server15.thcservers.com ESMTP Exim 4.96.2 #2 Thu, 23 May 2024 09:19:06 -0400 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 23, 2024 15:19:06.341530085 CEST	49741	587	192.168.2.9	91.235.116.231	EHLO 724536
May 23, 2024 15:19:06.559581041 CEST	587	49741	91.235.116.231	192.168.2.9	250-server15.thcservers.com Hello 724536 [8.46.123.175] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
May 23, 2024 15:19:06.559787035 CEST	49741	587	192.168.2.9	91.235.116.231	STARTTLS
May 23, 2024 15:19:06.778594971 CEST	587	49741	91.235.116.231	192.168.2.9	220 TLS go ahead

Target ID:	0
Start time:	09:14:55
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe"
Imagebase:	0x270000
File size:	329'216 bytes
MD5 hash:	14F0B309C14C5F5E75C9A1D95967318B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1273273213.0000000003619000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:14:55
Start date:	23/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x670000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3734809898.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3744691064.0000000002AEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Executed Functions

Function 024FC1D8 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 024FC43E

Memory Dump Source

Source File: 00000000.00000002.1273152913.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_hesaphareketi-015232024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 41d54b54dd47df4344920420e6e179545d973277a239115536e63d5b334b1a48
Instruction ID: fc23856db8f815ef7e25de9471d789cdab5edb83505c9feaa8867b4a93389808
Opcode Fuzzy Hash: 41d54b54dd47df4344920420e6e179545d973277a239115536e63d5b334b1a48
Instruction Fuzzy Hash: BF813570A00B458FD764DF6AD09079ABBF1FF88204F00892ED58ADBB40D774E84ACB91

Function 024FE7E8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024FE86F

Memory Dump Source

Source File: 00000000.00000002.1273152913.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_hesaphareketi-015232024.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6fe006f69e6bc3c12d8f08b4579f4e7d0f1e013735e0e0d5d4fb713ebac06755
Instruction ID: f7761688b6b16b743be1caef4a8af6ebc2af8d7c2bf3d71c1be5f779ec7d883e
Opcode Fuzzy Hash: 6fe006f69e6bc3c12d8f08b4579f4e7d0f1e013735e0e0d5d4fb713ebac06755
Instruction Fuzzy Hash: 4821E4B5D002099FDB10CF9AD584ADEFBF4FB48310F14842AE918A3350D374A940CFA0

Function 024FBE30 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,024FC4B9,00000800,00000000,00000000), ref: 024FC6CA

Memory Dump Source

Source File: 00000000.00000002.1273152913.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_hesaphareketi-015232024.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 0739ae69a2fb75835b7f461c85a5cbcc0841cf620a1be730d4f76d6dc802af69
Instruction ID: 2ae5b152a713a5d7469eef51e64a919947a4ec0beeccb8f988b421caf57b8dad
Opcode Fuzzy Hash: 0739ae69a2fb75835b7f461c85a5cbcc0841cf620a1be730d4f76d6dc802af69
Instruction Fuzzy Hash: 511100B69043099FEB10CF9AD484B9EFBF4EB88610F10846AE519A7600C3B5A545CFA9

Function 024FC3D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 024FC43E

Memory Dump Source

Source File: 00000000.00000002.1273152913.00000000024F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_hesaphareketi-015232024.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ec7a05783fe6709636e842be7a2671fa6f527c2e0cca14e18be0db5dba5701ed
Instruction ID: e6e24134d5179cab70757cc415e02f6f17e2b0f58de148095be49edfdc5bd29c
Opcode Fuzzy Hash: ec7a05783fe6709636e842be7a2671fa6f527c2e0cca14e18be0db5dba5701ed
Instruction Fuzzy Hash: 2F11DFB6C006498FDB10DF9AD484BDEFBF4AB88214F10846AD919A7610D379A545CFA1

Function 008BD5B8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271640816.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_hesaphareketi-015232024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44d189abc205fb81bceac5feb0c0b4ba249fb27bef884a0d8f35120d9e4ed5b
Instruction ID: 03ee56838ca2a0f4cd94059bc5fc41f7ee24cda5bca0690bb9c24252645882fa
Opcode Fuzzy Hash: c44d189abc205fb81bceac5feb0c0b4ba249fb27bef884a0d8f35120d9e4ed5b
Instruction Fuzzy Hash: 9F2145B1500304EFDB14DF10C9C0F66BB65FBA9318F248169E80A8B346D336D856CBE2

Function 008CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271689616.00000000008CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8cd000_hesaphareketi-015232024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b701f304bd79394923d169fe25376778652de99d426ed9c58be8d01f04c9bf4
Instruction ID: 3a416e3c4e1c589a914b81e9b5777e08a635219763d41a4da862128ae38adcee
Opcode Fuzzy Hash: 8b701f304bd79394923d169fe25376778652de99d426ed9c58be8d01f04c9bf4
Instruction Fuzzy Hash: 5021C1715047449FDB14EF18D5C0F16BB65FB84314F24C57DD80A8B286C336D847CA62

Function 008BD5B3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271640816.00000000008BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8bd000_hesaphareketi-015232024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction ID: 07f26bf082069ea76d76364bc9ab79ec420a6ea5be90805ef95b57e79ae88a2f
Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
Instruction Fuzzy Hash: 3411DF72404240DFCB01CF10D5C4B56BF61FBA5314F2486A9D8094B256C33AD856CBA1

Function 008CD017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1271689616.00000000008CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8cd000_hesaphareketi-015232024.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction ID: ff91af9160c7b382c046a478cca47d437b390b0c8195279147e799b44188e011
Opcode Fuzzy Hash: 0571d9b095afed8b546122286ae05565a289416437c47d1601190cbee81fcf2c
Instruction Fuzzy Hash: 52118B75504780DFCB15DF14D5C4B15BBB2FB84314F28C6AED8498B696C33AD84ACBA2

Analysis Process: RegAsm.exePID: 2796, Parent PID: 2444COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	5

Executed Functions

Function 00CCA950 Relevance: 3.1, Instructions: 3107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c772d1df52bf24722e9d56e395632388c30187c9c794c7f3b04fdc946630664
Instruction ID: 755f6b34ab15ea1d0ff7c8c2736cbd03f15ea078933ba979eee8724c7cbeb10f
Opcode Fuzzy Hash: 8c772d1df52bf24722e9d56e395632388c30187c9c794c7f3b04fdc946630664
Instruction Fuzzy Hash: 55630D31D10B198ACB11EF68C894AA9F7B1FF99300F15C79AE45977121EB70AAC5CF81

Function 064056B0 Relevance: 1.8, Strings: 1, Instructions: 593
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$, xrefs: 06405A2C

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 19e7b4aa2f495a54a4a207c1c93acf20c54acfb2ce675ae07ee1338f9714b102
Instruction ID: e03a7f231c11d42fcfff92ac2d5a9d0b961a83b704a9bdd6332224d60cbb7fb0
Opcode Fuzzy Hash: 19e7b4aa2f495a54a4a207c1c93acf20c54acfb2ce675ae07ee1338f9714b102
Instruction Fuzzy Hash: DA22B375E102258FEB69DBA4C5806AFBBB2EF85310F24847AD415AB385DB35DC41CFA0

Function 06402358 Relevance: 1.5, Instructions: 1530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf0d7eba159870a4f11837b126ee1be90d4ce60593f394ec89bffde435952da
Instruction ID: 8cc1ef1a704d027d84e1174dd613ad9e26b6c774d94e3f2a6c6886b38073fbeb
Opcode Fuzzy Hash: fdf0d7eba159870a4f11837b126ee1be90d4ce60593f394ec89bffde435952da
Instruction Fuzzy Hash: 2FE23B34A00215CFEB65DF68C584A9EBBF2FF89304F5485AAD409AB391DB70DD85CB50

Function 064066E0 Relevance: .8, Instructions: 810COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55b7905b65479a8cf3c8644fcae4d2079c94e6ddc17e1c93805556914d29969
Instruction ID: 08312ce0c49e3c17effa93cfc3b4d84f57aaeb0dfd3041c970bee46b1542f1ad
Opcode Fuzzy Hash: f55b7905b65479a8cf3c8644fcae4d2079c94e6ddc17e1c93805556914d29969
Instruction Fuzzy Hash: 9362AF34B002248FEB55DB68D594AAEB7F2EF88314F15847AE406DB391DB35EC41CB90

Function 0640B328 Relevance: .8, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc5df8ec6eab2c294bd27465fd717c3432d93f37e2ca2be9d863870b653987d3
Instruction ID: 2e0ae62ab5a51576e5d0ee50a8347191131e7fea51ec4ab991cb002257e38869
Opcode Fuzzy Hash: bc5df8ec6eab2c294bd27465fd717c3432d93f37e2ca2be9d863870b653987d3
Instruction Fuzzy Hash: C5527030E102198FEB65DB68D5907AEB7B2FB49310F24883AE405EB391DB36DD41CB95

Function 0640C268 Relevance: .6, Instructions: 638
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c544933f07fe46fb0b5d9e76fa18b523a86e3b1ab913d17f6cb87862830808b
Instruction ID: 4a0a838cb2c2436fcce32b985d5ece85ea42686b7748f28bdc8bb5ef3ff7f17b
Opcode Fuzzy Hash: 2c544933f07fe46fb0b5d9e76fa18b523a86e3b1ab913d17f6cb87862830808b
Instruction Fuzzy Hash: 46329D35B00219CFEF55DB68D580BAEB7B2EB88314F148A2AE405E7795DB35EC41CB90

Function 06407E70 Relevance: .5, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8063c8ccbcdf39a6aaca3826ed2392ba755aa8d73a23dc1d3e314868a09c9f3
Instruction ID: 5b595c689dda21920ae72f7548151f7d6b10b8b084703ca402639373d1827358
Opcode Fuzzy Hash: b8063c8ccbcdf39a6aaca3826ed2392ba755aa8d73a23dc1d3e314868a09c9f3
Instruction Fuzzy Hash: A202AC30B002258FEF55DB64D990AAEBBB2FF88314F14893AD4159B391DB35EC42CB90

Function 00CCE290 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a861f7c4003d0bb373fdb1f30e64fa5235148d69058fc878b5ee990bdaed5f
Instruction ID: ac1c74c623f675d6cc35440c176501f1d18759ef232e2f5d83466e7774c43475
Opcode Fuzzy Hash: a0a861f7c4003d0bb373fdb1f30e64fa5235148d69058fc878b5ee990bdaed5f
Instruction Fuzzy Hash: D9B1B134B002189BDB19AB75D86477E7BB7BFC9700B18882EE446E7384DE34DC029B91

Function 00CC41C8 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde0d47eaa54a115970e4550e954a2ed632f6432acedea499afaba3dbb605ad2
Instruction ID: 77845d6bd9c10fc345e00d1274f4d8e7c7d581e185691717dbb66d590c7cd417
Opcode Fuzzy Hash: cde0d47eaa54a115970e4550e954a2ed632f6432acedea499afaba3dbb605ad2
Instruction Fuzzy Hash: 10B13D70E00249CFDB18CFA9C895B9DBBF2BF88314F24C52DE815A7294EB749945CB81

Function 00CC4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3c045b9dcf1476ec10a79302681b2f34286b991c8c79648daaaec518f483904
Instruction ID: 61505c14b670538cb2571d1b462319f4e4714fc9ce86238214367596818a1bb4
Opcode Fuzzy Hash: b3c045b9dcf1476ec10a79302681b2f34286b991c8c79648daaaec518f483904
Instruction Fuzzy Hash: 14B15C70E00609CFDB18DFA9C8A5B9DBBF2AF88314F14C52DD815E7294EB749945CB81

Function 00CC3E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e835f1a8397b3495b92bed68f227001131806faef1efd865b60a08eb4aeee1fe
Instruction ID: 7d3302c56e57bbf3d70ed3b2af0f76d9c212023bdb557fa7c63ff683d1f8af90
Opcode Fuzzy Hash: e835f1a8397b3495b92bed68f227001131806faef1efd865b60a08eb4aeee1fe
Instruction Fuzzy Hash: 29914970E00249CFDB14CFA9D995B9EBBF2AF88304F14852DE415A7254EB749986CB81

Function 00CCEB28 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd31e316cbb8e36cdbefca177a1957643b0ab1a17b038c699a53a7afc706020
Instruction ID: 1fd6319dfb6e80c6a75c323227864029505fd4d575d90c63affced70380c9f06
Opcode Fuzzy Hash: bbd31e316cbb8e36cdbefca177a1957643b0ab1a17b038c699a53a7afc706020
Instruction Fuzzy Hash: F7411172D0075A8FDB14CFB9D8047AEBBF1AF8A310F04856AD408A7641EB789945CB90

Function 00CCE718 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,00CCEB7A), ref: 00CCEC67

Memory Dump Source

Source File: 00000002.00000002.3743356461.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_cc0000_RegAsm.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: fecfde2246b3389277f242b70b15d233dc7138d04ab327e1d8c42523ff81aad7
Instruction ID: 55d087fcc2227068cd443fc38689df85b53bbbd9b6b24de958551b03b6902b9b
Opcode Fuzzy Hash: fecfde2246b3389277f242b70b15d233dc7138d04ab327e1d8c42523ff81aad7
Instruction Fuzzy Hash: 0C1103B1C0065A9BDB10CF9AC544BDEFBF4AB49320F15856AD818B7240D378A944CFE5

Function 0640D038 Relevance: .8, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae862b4ec23f254976d1c7a342dd106c1498e1d8cf5716b3d84e2d3e8a38a6b
Instruction ID: 4cf046b611a2e16bb590f2c1bf6f3cdfeeafc6a0322c3f088c478277af09bd7a
Opcode Fuzzy Hash: 9ae862b4ec23f254976d1c7a342dd106c1498e1d8cf5716b3d84e2d3e8a38a6b
Instruction Fuzzy Hash: 22624D30A0071A8FDB55EFA8D580A5EB7F2FF84304B248A69D0059F759DB71ED4ACB90

Function 0640ADC0 Relevance: .4, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a2b9d02d65fbaadea4a45d46fffda0d21ebc5634762b45f1d529d9940f0180
Instruction ID: bb31b71cc6cafb5e6e840c946a93e6647ffdaa8eb4fff811d1fb9939449aa7dc
Opcode Fuzzy Hash: a4a2b9d02d65fbaadea4a45d46fffda0d21ebc5634762b45f1d529d9940f0180
Instruction Fuzzy Hash: 23E17F70E103198FEB65DB64D4946AFB7B2FF89300F10853AE405AB395DB75D882CB90

Function 0640B318 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55f10f797d03bf7bb16170928e3b099dbcd0392b9b96c4a62e5d1a280795ccf9
Instruction ID: 4d3e191da9df46dff296b492928c6e6edb0fe28068815c1670563ce5b7292436
Opcode Fuzzy Hash: 55f10f797d03bf7bb16170928e3b099dbcd0392b9b96c4a62e5d1a280795ccf9
Instruction Fuzzy Hash: E4A1A234E102289BFF65DAA8D5907AF77B2FB89310F208836E405E77D1CA36DC419B56

Function 06409238 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a79026dc61032333ff38fe1a1715c58c7841dbe23b47ed2a8248de85b7e2377a
Instruction ID: d44b98ebd1f2cde9c732f873678df9aad3097e179c1ceb8f3b7aab5b843ac3ea
Opcode Fuzzy Hash: a79026dc61032333ff38fe1a1715c58c7841dbe23b47ed2a8248de85b7e2377a
Instruction Fuzzy Hash: E1915130B002198FDB55DB69D9A07AF77F2AFC9304F14856AC449EB396EB719C428B90

Function 064062E0 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 749e545d682e2545383318973f31a0d4d0c0ee075d42f2678be5d43e624a5d52
Instruction ID: 5d168f75f8e29ec89925881eaa2a449d716b954fcb7a93d71d09cc91978b506c
Opcode Fuzzy Hash: 749e545d682e2545383318973f31a0d4d0c0ee075d42f2678be5d43e624a5d52
Instruction Fuzzy Hash: 9B61D371F001214BEB119B7EC99466FBAE7AFC4220B1A443AD80EDB364DE75EC0287D1

Function 064043A8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb6b79fa1c64cbb0259833738138055ee40c6bf5e55934511e97a7cae0443141
Instruction ID: 300490089890844a464bba1f5ca4da2d58493fc576f74f937df77fb70c2c7f78
Opcode Fuzzy Hash: bb6b79fa1c64cbb0259833738138055ee40c6bf5e55934511e97a7cae0443141
Instruction Fuzzy Hash: 20816F30B102198FDB55DFA8D5A07AEBBF2AF89304F14843AD50ADB395EB35DC428B51

Function 064046C8 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df865c8c57784b595ea82cb711700e46d058dae6bbe8be2c2432593931134a7
Instruction ID: 08ff18347e8a1ffa58698089c729a47064744bd8e603ca67116391a9498437dc
Opcode Fuzzy Hash: 3df865c8c57784b595ea82cb711700e46d058dae6bbe8be2c2432593931134a7
Instruction Fuzzy Hash: 1A914F70E00619CBEF61DF68C890B9DB7B1FF85310F2085A6D549AB385DB70A985CB90

Function 064043B8 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eb4841c3b998210a6f506b82d8a02e6c37513566bebd9cda19baa2360e7ebd1
Instruction ID: 163aae29128b4cdef175fa44936c072397c934df0d4fb50533f8f80d79e634ef
Opcode Fuzzy Hash: 2eb4841c3b998210a6f506b82d8a02e6c37513566bebd9cda19baa2360e7ebd1
Instruction Fuzzy Hash: 4C815F34B102198FDF55EFA8D5A07AEB7F2AB89304F14843AD50ADB395EB34DC428B51

Function 064046E0 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bde06dfaf80dfd2375ce13f64b5bdf3d4c582db06fc50aa1bcd8db8161769731
Instruction ID: e33b60d542532ebd020444af1c5871ea4446ccdb5489443c5bce2b615e2090bc
Opcode Fuzzy Hash: bde06dfaf80dfd2375ce13f64b5bdf3d4c582db06fc50aa1bcd8db8161769731
Instruction Fuzzy Hash: AF911E74E10619CBEF60DF68C890B9DB7B1FF89310F2085A5D549BB385DB70AA858F90

Function 0640EC10 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0393119b7cf2d5bef77ef3d6611a3a987b835956611f3bcff53a629f3940ef00
Instruction ID: 9315372c8f87e6713ed83ccc1276fd4dae5f272708b73e237ca3f4139a7e0679
Opcode Fuzzy Hash: 0393119b7cf2d5bef77ef3d6611a3a987b835956611f3bcff53a629f3940ef00
Instruction Fuzzy Hash: 76713C71A002199FEB54DBA9D980A9EBBF6FF88300F14882AD415EB355DB30ED56CB50

Function 0640EC02 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab671a84592ab226957743aabde4ecf36241d7bf0f6cf3f7455eb05d4cb55e3
Instruction ID: 44de564a3a54ade9bc345537ca7480165fd6fbdbf39d43d257d9013d2aff3833
Opcode Fuzzy Hash: 3ab671a84592ab226957743aabde4ecf36241d7bf0f6cf3f7455eb05d4cb55e3
Instruction Fuzzy Hash: D5714C71A002198FDB55DBA9D980A9EBBF6FF88300F14882AD415EB395DB34E946CB50

Function 06404C78 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a566ad6f7a7a5ee275527315d60939ced8cd85d3a3102296bb60a93f7e8827
Instruction ID: 56a1e0bb88e87765cb75f26e3466d7d46f799332f70e7dfb17153d707b81ac6c
Opcode Fuzzy Hash: 99a566ad6f7a7a5ee275527315d60939ced8cd85d3a3102296bb60a93f7e8827
Instruction Fuzzy Hash: BE614E30F10218DFEB55DBA5D8547AEBBF6EB88300F20842AE105AB395DF758D459B90

Function 0640FD80 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce7eebfea0197334fc0ad1755024d7057ebd2eb8bcacad3b6d0b9d6e284f6a99
Instruction ID: b1a0ca2d509c142532ee8b623d740e10a29ace1410ac96f3d67e84e2c4fb2709
Opcode Fuzzy Hash: ce7eebfea0197334fc0ad1755024d7057ebd2eb8bcacad3b6d0b9d6e284f6a99
Instruction Fuzzy Hash: 9451A331E00115DFEBA5AB78E4447AEB7B6EF85311F20487BE906D7390DB359859CB80

Function 0640922E Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e287dd90e37b45aedc955283c5ab320b8ca2dad6b9e0ca06bc57328e37bd7b4f
Instruction ID: bb9b158ad09ce0f34b009bfa041633e66c6862b768612428e826fdf99ca908fc
Opcode Fuzzy Hash: e287dd90e37b45aedc955283c5ab320b8ca2dad6b9e0ca06bc57328e37bd7b4f
Instruction Fuzzy Hash: D2515030B001159FDB55DB68D9A0BAF77F2EB88704F54887AC849DB796EB319C028B90

Function 0640FB20 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 191e8b94ec65ad4f2e5d62320f9a851f4b858a0f9d9e10d420616c5febf6ffcc
Instruction ID: 0137bf55b4824efb9788be3f5ca39e3276f2c8c3bdfa7ffd58b8c5e09305e890
Opcode Fuzzy Hash: 191e8b94ec65ad4f2e5d62320f9a851f4b858a0f9d9e10d420616c5febf6ffcc
Instruction Fuzzy Hash: 2451C731B102198BFFB5A668E89472F366AFB89710F10443AE90BC73D5CA79CC468791

Function 0640FB30 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 976a70aa678b499cf4c326d38cdbe2aec298a412977733f2b7197da4ec0189ea
Instruction ID: 9084ebb2200a6b6c7ce2b7e0f316851b5955959cce02b6adf7bd30e49c5f0815
Opcode Fuzzy Hash: 976a70aa678b499cf4c326d38cdbe2aec298a412977733f2b7197da4ec0189ea
Instruction Fuzzy Hash: 3851B931B102198BFFB5A668D89472F766AEB89710F10443BE90BC73D5CA79CC464791

Function 06404C68 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f2aabf6551f890c9cb97a47cfa3a0e031a95d25adf3610b8d561d336b9f2ce
Instruction ID: 1fdd13acd304f0944de51a97d11bb6079008d6e7cd18bda1cab789006614b1c5
Opcode Fuzzy Hash: a4f2aabf6551f890c9cb97a47cfa3a0e031a95d25adf3610b8d561d336b9f2ce
Instruction Fuzzy Hash: 60516F70F002189FEB55DFA5C854BAEBBF6EF88700F24852AE105AB395DB759C019B90

Function 06405530 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ceafb8b796ade31c343dfab95f28ac1d1a16632ebb70203f04e8d32545b9c4e
Instruction ID: b73adb2e56329c3d98509ac828c5f528fdac28599dda08175f4a3a8f58370ccb
Opcode Fuzzy Hash: 0ceafb8b796ade31c343dfab95f28ac1d1a16632ebb70203f04e8d32545b9c4e
Instruction Fuzzy Hash: D2415F75E006198FEF75CEA9D980AAFF7B2FB84210F10493AE11AD7694D630E9458F90

Function 0640DBC0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95c8af7b724d7712172a9165e0c52e47f0e8630ecebb55edb4caf62e0d21901
Instruction ID: 52ffeb2d17ad45c6056b3b1d206151d2da76fd28e8387ef45ba81542be236397
Opcode Fuzzy Hash: f95c8af7b724d7712172a9165e0c52e47f0e8630ecebb55edb4caf62e0d21901
Instruction Fuzzy Hash: CF417F30E10719DBEB65DFA5D4447AEBBB2BF85300F20852AD406EB380DB71D94ACB91

Function 0640DBAD Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2e146320ceafeb88f90a00d2aeae2ffffb558ad630b42648b490c3ae6a068c
Instruction ID: 2d0a5799543cae935194aaf16eb2bb6fabb892a240475381be9c96a610e28ec6
Opcode Fuzzy Hash: 6a2e146320ceafeb88f90a00d2aeae2ffffb558ad630b42648b490c3ae6a068c
Instruction Fuzzy Hash: 39417D70E10759DFEB55DBA4D48479EBBB2BF86300F24852AD405EB380DB74D84ACB91

Function 064021BD Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50114523f4c6715457a394a4c9f92018acf096c1870578e388abed802435529
Instruction ID: cda221d6030ca1c905dcc91b1620a485e6f00145578f4bdfc75d5a84253ca93a
Opcode Fuzzy Hash: f50114523f4c6715457a394a4c9f92018acf096c1870578e388abed802435529
Instruction Fuzzy Hash: DA31E030B102518FEB56ABB4D5587AF7BA2AF8A204B24447ED402DB3D2DF75CD06C790

Function 064021D0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e47f13a2a8da15f1cf3e54eab4ddf996a75a405d050f5360b5f74dd3406a3c
Instruction ID: 01442635c5b325ade8d7b93f95ba83c5b60564243b3b91d42b29054355e0ef21
Opcode Fuzzy Hash: e2e47f13a2a8da15f1cf3e54eab4ddf996a75a405d050f5360b5f74dd3406a3c
Instruction Fuzzy Hash: 6431CD30B102158BEB59ABB4D55876F7BA2BB89204B24843DD406EB3D1DF75CE06CBA1

Function 06402080 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44db0accb46119ab4e521a082cb2f98e069251a38df12443625c65d8d4b1c44
Instruction ID: 87721c104f26efcecd22088c100fa4ba94ef0c784e49a91729096184c8b7edd8
Opcode Fuzzy Hash: c44db0accb46119ab4e521a082cb2f98e069251a38df12443625c65d8d4b1c44
Instruction Fuzzy Hash: F431A635E102199BDB1ACF64D56869FBBF2FF89300F10852AE905EB391DB71AD42CB50

Function 06402090 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c4af8b6e42af340ea4d9d435e55e240c813b5f8d2502f415646008aad0fd4d
Instruction ID: ed80af129f17cb94056b1fd0f895507a27de8200f776378801cf2cb884471c44
Opcode Fuzzy Hash: 13c4af8b6e42af340ea4d9d435e55e240c813b5f8d2502f415646008aad0fd4d
Instruction Fuzzy Hash: 19316535E106199BDB1ACF64D95869FBBF2FF89300F10852AE905EB390DB71AD41CB50

Function 06403BA8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f69a8db7cbcabc683a8c1d6c4ea28dc95813813be9b501a617f7f17367a1c4
Instruction ID: 5a8dc77915a13360b9c3851ada6a3c1bcc82bed2e833cfbc391d622b29bc0279
Opcode Fuzzy Hash: e7f69a8db7cbcabc683a8c1d6c4ea28dc95813813be9b501a617f7f17367a1c4
Instruction Fuzzy Hash: 55216D76F002199FEB41DF69D980AAEBBF1EB48754F14802AE905E7391E734D841CBA4

Function 06403BB8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 985108634b30b8a028dcda1e9a915445dac81dfc2ed38855b5d59b086bfe1ca5
Instruction ID: 4ffd22ade9979a303ecf38526a4f3b29db936286926859906269852be0191c89
Opcode Fuzzy Hash: 985108634b30b8a028dcda1e9a915445dac81dfc2ed38855b5d59b086bfe1ca5
Instruction Fuzzy Hash: B9217C75F006259FEB51DF69D980AAEBBF1EB48714F10803AE905E7391E734D8418BA4

Function 00C3D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3741415141.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145629b5113748f3d6622d7abbc54e4d1b655b06902001ca1d2573d7aeabcffc
Instruction ID: 6214658fd5514153b174bf4c39abecb2ef4661df35b611cbcf1963ade998711f
Opcode Fuzzy Hash: 145629b5113748f3d6622d7abbc54e4d1b655b06902001ca1d2573d7aeabcffc
Instruction Fuzzy Hash: EC210471514344DFDB18DF20E9C0B26BB65FB84714F24C5ADE84A4B282C736D846CB62

Function 00C3D20C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3741415141.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5016caa9689d475fc311f997769d4651879d6383bbb519c8ba35cfb5413eb11
Instruction ID: 5e0d4d6ceb6fddae2fd6ab351375ad1014222d90b4b7c8e8f888688718390650
Opcode Fuzzy Hash: b5016caa9689d475fc311f997769d4651879d6383bbb519c8ba35cfb5413eb11
Instruction Fuzzy Hash: 9E210571514344DFDB05DF10E9C4B2BBB65FB84324F24C6A9E84A4B242C777DC46CAA2

Function 00C3D3BC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3741415141.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c9c772ae6efada7ac7151ab00d2e8afcbb6540ddce8f82dffeadfa6c5ec34e
Instruction ID: 22c302f488875dc97a98d1dbe962b9d5acc83fef0bf11212987b8ea89343951c
Opcode Fuzzy Hash: 43c9c772ae6efada7ac7151ab00d2e8afcbb6540ddce8f82dffeadfa6c5ec34e
Instruction Fuzzy Hash: C52126B5514344DFDB04DF10E9C0B26BB65FB84314F24C56DE80A4B292C776E846CBA2

Function 06403CC8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 729e86ac0c8caf442bb8c4cbbb86969ce82b22d2c7cc3b688d64e7ffeb1244ea
Instruction ID: 8f12a98ee931983d1a8f96837aa20399e981b0a0d268864d8eb01e99c02185c6
Opcode Fuzzy Hash: 729e86ac0c8caf442bb8c4cbbb86969ce82b22d2c7cc3b688d64e7ffeb1244ea
Instruction Fuzzy Hash: B0118232B101294FDF569A69D8546AF77EAABC8351F04453AD406E7394EF35DC028B90

Function 06404308 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae79a41ac94d8989c4f35a3bb63e1e013bc23583c914ed5671268e9039b53ff4
Instruction ID: 254effae0a8b0d6b9ad28cdc38fb757b0100ad69b6bef6073d7fab11dabcc386
Opcode Fuzzy Hash: ae79a41ac94d8989c4f35a3bb63e1e013bc23583c914ed5671268e9039b53ff4
Instruction Fuzzy Hash: 2601F131B002204FEB6695BDE51571F67D6CBCA720F10983EE20AC7B82DE71DC024391

Function 0640EE81 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5f4c02daf6e1b049d5ce5f3ffd37e942b5c5536a921690590abd7a780ca3e41
Instruction ID: dc8699eedae68856152d8867bd519dc73f221da1f81fa9fc1fb63c570b501e5d
Opcode Fuzzy Hash: d5f4c02daf6e1b049d5ce5f3ffd37e942b5c5536a921690590abd7a780ca3e41
Instruction Fuzzy Hash: 8901B535B001100BEB56962C945572BB7E6DBC9720F14893EF50AC7382DA31DC1243D5

Function 06403CB8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49de5b9167531ed6422ee210f8a298b392e99151459847a3dc40804b8344a18
Instruction ID: be511787a1d841218f52c9d3a9e0e483a1499e5d5a66856f6b5a70abfe21d2de
Opcode Fuzzy Hash: e49de5b9167531ed6422ee210f8a298b392e99151459847a3dc40804b8344a18
Instruction Fuzzy Hash: F101D233B100254BDF8699AAC8546AB7BAB9BC5620F04403AD406D7390EF21880187D1

Function 06403980 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61abc71856ea4c4731658154ddbeb4ca55c48937c6e7de4a6fd187f3abe7e382
Instruction ID: 193fcb0a41a88d601ec13f00103dace2069ea611bb2e8951a2105ecc0539be29
Opcode Fuzzy Hash: 61abc71856ea4c4731658154ddbeb4ca55c48937c6e7de4a6fd187f3abe7e382
Instruction Fuzzy Hash: E121EBB1C01259AFDB00CF9AD984ADEFFB4FB49320F10812AE918B7240C374A944CBA5

Function 00C3D207 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3741415141.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ca49e0dbf2e9aadfdf1ca98bc1f242d09976a6448f2b599f30b6482e13893a
Instruction ID: eba19c9c336e07c89002ad68d81ef9d813ab574ebe4466bb2c70561892594e08
Opcode Fuzzy Hash: 13ca49e0dbf2e9aadfdf1ca98bc1f242d09976a6448f2b599f30b6482e13893a
Instruction Fuzzy Hash: C811B275504284CFDB12CF10D5C4B56FB61FB84324F28C6AAD8594B646C33AD94ACB51

Function 00C3D3B7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3741415141.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fc8320e9ffd4f8ec94d9e167b65ccdea872c3a8bd4eb18a3b2cc6050ea0561
Instruction ID: 9d5cc628a42bdc667b10a23efae6c1013f760b4523e00025c832b839e5a4b292
Opcode Fuzzy Hash: d7fc8320e9ffd4f8ec94d9e167b65ccdea872c3a8bd4eb18a3b2cc6050ea0561
Instruction Fuzzy Hash: 25119D75504680DFCB05CF10E5C4B15FBA2FB84318F28C6AAD85A4B656C33AE94ACFA1

Function 00C3D03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3741415141.0000000000C3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c3d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7fc8320e9ffd4f8ec94d9e167b65ccdea872c3a8bd4eb18a3b2cc6050ea0561
Instruction ID: 774d74ad45b1117a155d52fa75faa1182a2381e8773eb6a71e8d72161120b564
Opcode Fuzzy Hash: d7fc8320e9ffd4f8ec94d9e167b65ccdea872c3a8bd4eb18a3b2cc6050ea0561
Instruction Fuzzy Hash: 5F11D075504284CFCB15CF10D9C4B15FB61FB44314F28C6A9D84A4B652C33AD94ACF52

Function 0640A3F0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f13b8208e73a80bacf5cb4774584cb69587bbc3ffc6a1b5497d74e42d66023
Instruction ID: d3a10259140589d2aae4cd70e55b769c16f6e4b1ca318903cd716943399e034c
Opcode Fuzzy Hash: 86f13b8208e73a80bacf5cb4774584cb69587bbc3ffc6a1b5497d74e42d66023
Instruction Fuzzy Hash: 5B01F735B102201BEB56A67CE55976B77D1DBCA724F508839E10AC7793DF34EC024781

Function 06403988 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d7da2e5231a20090f0c7131b5b6a1109edb8375abed12de7702053b195c0aa
Instruction ID: 7d025bad2cc5051a8b1aed9e653966ebc9a442b9315b0686d09c4e9a460345fa
Opcode Fuzzy Hash: e5d7da2e5231a20090f0c7131b5b6a1109edb8375abed12de7702053b195c0aa
Instruction Fuzzy Hash: B611CCB5D01259AFDB00CF9AD984ACEFBB4FB49320F10812AE918A7240D374A944CFA5

Function 06404318 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e923da3c66815e1eec3b09c904cfeccde027ee80faded9c74b5d449c49073d7
Instruction ID: e5b943110b660c0a4e070c159bbe545e4f7923a110cb2bb8a1825875d596c468
Opcode Fuzzy Hash: 3e923da3c66815e1eec3b09c904cfeccde027ee80faded9c74b5d449c49073d7
Instruction Fuzzy Hash: 66018131B101208BEB6695BDE51572FA7DADBCD720F10983EE20AC7B85EE75DC024395

Function 0640EE90 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc1b21cc35f9a596148d3e3a02caf2bc5ec5d5980002ea724e63dba8027e617b
Instruction ID: f4af5a2bc1cacbea47cca2276999597f346b00419742977f79683dbab8b5e6be
Opcode Fuzzy Hash: fc1b21cc35f9a596148d3e3a02caf2bc5ec5d5980002ea724e63dba8027e617b
Instruction Fuzzy Hash: AB018C31B105241BEB66956CA45872FA7DADBC9720F108C3EF60AC7381EE35DC1243D5

Function 0640A400 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb8bd219a129eb6a0afd9dee0a5c14b68e47b9b6bd998e3809e8b54f807f083
Instruction ID: e48e4bf78e292c6664d305f276e751970578841aec09ac34a3e4f259ef91bdd9
Opcode Fuzzy Hash: bdb8bd219a129eb6a0afd9dee0a5c14b68e47b9b6bd998e3809e8b54f807f083
Instruction Fuzzy Hash: BF01D135B102201BEB62A66CE458B2B73D5EBC9714F50883AE50AC7792DF31DC414780

Function 00C2D8C5 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3740359288.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8832a0254b9d4e9b8810a54de627d5ab0501e0ad70331a6b241700bc6e742026
Instruction ID: e40d8d9623743dcf396fb3fdb8f0018343d6d97a649c23e5e308873f8b6669eb
Opcode Fuzzy Hash: 8832a0254b9d4e9b8810a54de627d5ab0501e0ad70331a6b241700bc6e742026
Instruction Fuzzy Hash: C60176310043509FF7109E16ED84B26BBD8EF61320F18C42AFD1A4A682CA39C980CBB2

Function 00C2D8C4 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3740359288.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_c2d000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc3415171479863167d6b3a0b676562a0a3aa615a831ad97de2aaa93ee78b34e
Instruction ID: ebaf43c49351c9aaeb65bbb29bacbfb25fc674fc468bdc7c0981096787983010
Opcode Fuzzy Hash: cc3415171479863167d6b3a0b676562a0a3aa615a831ad97de2aaa93ee78b34e
Instruction Fuzzy Hash: 70F0CD32004340AEEB508E06DD88B62FFD8EB91735F18C45AED594A686C6799C80CBB1

Function 0640C8C0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe045390f208e3b91d04d68a7f45f7d0da716cc06df12dc4ee69fb3cf6ca6fba
Instruction ID: 5cd991e99d79d53c4af251ded80a1313c11e9771de64dc96df2b5ae086f2bdde
Opcode Fuzzy Hash: fe045390f208e3b91d04d68a7f45f7d0da716cc06df12dc4ee69fb3cf6ca6fba
Instruction Fuzzy Hash: 7BF0A732F20238DBDB1495A5DC41A9BB739E784354F10453AED01E7384D771AD01CBC0

Function 0640FD71 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa14a4831c35644abf52b6a45f79115015d65dd2455bb9e8a60337c0d34abe66
Instruction ID: 62e7df13e6e6eaed9a7056bf39115783eef16245c1905ca84d3f5b1f4f6bd074
Opcode Fuzzy Hash: fa14a4831c35644abf52b6a45f79115015d65dd2455bb9e8a60337c0d34abe66
Instruction Fuzzy Hash: BAE06833B201289BCB244CB5EC99ADBB76AEBC5321B00043EEA01E3380DD31980287D0

Function 06406560 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a78ade4a582aa0df212cb77d53018db7db26059176967ab1b1a5b4b02fd7cfe
Instruction ID: be642129049e5a65422681bd0b622acb9dc1547e7b610b27806bd9dc04cef492
Opcode Fuzzy Hash: 1a78ade4a582aa0df212cb77d53018db7db26059176967ab1b1a5b4b02fd7cfe
Instruction Fuzzy Hash: 95E026B1E20114ABEF92CEB0EB423AB3769EB41204F218DB7D409DB382F172CE124740

Function 06406570 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a819bebf4c8c3eda4bd26fa7b91ff0f2dcd43c419868069b5cf496221e9d8ed
Instruction ID: dd664ca5c121e0282c4cc973b03e9ca78c444c90219a09728ee753a1da956a02
Opcode Fuzzy Hash: 6a819bebf4c8c3eda4bd26fa7b91ff0f2dcd43c419868069b5cf496221e9d8ed
Instruction Fuzzy Hash: 98E0C270E10118ABEF51CEB0EA4575F77ADD701204F2188B6D80ADB382E132DE114790

Non-executed Functions

Function 0640E498 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

Dq#p, xrefs: 0640E53C
0o#p, xrefs: 0640E530

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID: 0o#p$Dq#p
API String ID: 0-2938899007
Opcode ID: 53ad971babee934c09fda75f17e8b8e2c33277f4c887c06a30c124f771ebec67
Instruction ID: 88a795aaef584c034df6e20e4470abca08dd2acccb12ab386e5c1dc775f41c59
Opcode Fuzzy Hash: 53ad971babee934c09fda75f17e8b8e2c33277f4c887c06a30c124f771ebec67
Instruction Fuzzy Hash: 6E22AF31B102158FEB55DB68D484BAEB7B2EF89310F24887AD406DB3A1DB35EC51CB91

Function 06400040 Relevance: 2.0, Instructions: 1972COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e447b1c541eae803697623d3d0065470028a8aaee8ab2b88b12e3b1e8bd02a38
Instruction ID: a7662d01f769d58457b3117bad116c1f4d4f597e8bcc6aa09329918709340fcb
Opcode Fuzzy Hash: e447b1c541eae803697623d3d0065470028a8aaee8ab2b88b12e3b1e8bd02a38
Instruction Fuzzy Hash: 39230C31D10B198ADB11EF68C8946AEF7B1FF99300F15D79AE448B7251EB70AAC4CB41

Function 06405DF0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3749183991.0000000006400000.00000040.00000800.00020000.00000000.sdmp, Offset: 06400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6400000_RegAsm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651dd40e326bc87327d2d5a5f700148f426d0b0440ad96b1e27e51a9342035d0
Instruction ID: 085befa04ba28027750d37863961ff62bcee4388373584121f8990e84722dba6
Opcode Fuzzy Hash: 651dd40e326bc87327d2d5a5f700148f426d0b0440ad96b1e27e51a9342035d0
Instruction Fuzzy Hash: 70D10631B101248FEB55DB68D584BAEBBE2EF89310F25847BE50ADB391CA35DC45CB90

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hesaphareketi-015232024.SCR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-015232024.SCR.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
hesaphareketi-015232024.SCR.exe

Function 024FC1D8 Relevance: 1.7, APIs: 1, Instructions: 205
COMMON

Function 024FE7E8 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 024FBE30 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 024FC3D8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 064056B0 Relevance: 1.8, Strings: 1, Instructions: 593
COMMON

Function 0640C268 Relevance: .6, Instructions: 638
COMMON

Function 06407E70 Relevance: .5, Instructions: 469
COMMON

Function 00CCEB28 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Function 00CCE718 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Function 0640D038 Relevance: .8, Instructions: 800
COMMON

Function 0640ADC0 Relevance: .4, Instructions: 392
COMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre