Edit tour

Windows Analysis Report
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Overview

General Information

Sample name:	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
Analysis ID:	1461053
MD5:	68b15abf143f5df8aad10eab1d2513d5
SHA1:	cb2566d06a85191582ab524d68f38d85556fb880
SHA256:	c1aaa8b374f0c43ae3d8817ac7731f1f71d2d04089e9c51510cddf38097dfb54
Tags:	exe
Infos:

Detection

PureLog Stealer

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Yara detected PureLog Stealer

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe (PID: 7080 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe" MD5: 68B15ABF143F5DF8AAD10EAB1D2513D5)

setup.exe (PID: 732 cmdline: C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672 MD5: B005E4007EB93F23BB0E7F03FB634D46)

setup.exe (PID: 6016 cmdline: "C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=700 -burn.filehandle.self=708 AID=18672 MD5: 29467FD9BE93C4AC0BA9D863AE30EDF9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2937823185.0000000006B42000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2938282239.0000000006C32000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
5.2.setup.exe.6e80000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.setup.exe.63f0000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.setup.exe.6b40000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
5.2.setup.exe.6c30000.6.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.setup.exe.6c30000.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Snort Signatures

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 156.146.33.140

Timestamp:	06/22/24-06:27:57.276819
SID:	2020826
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://static.adtidy.net/windows/installer.exe	Avira URL Cloud: Label: malware
Source: https://static.adtidy.net/windows/installer.exe	Avira URL Cloud: Label: malware

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003E9F8F DecryptFileW,	4_2_003E9F8F
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_0040F340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	4_2_0040F340
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003E9D74 DecryptFileW,DecryptFileW,	4_2_003E9D74
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DC9F8F DecryptFileW,	5_2_00DC9F8F
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DEF340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	5_2_00DEF340
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DC9D74 DecryptFileW,DecryptFileW,	5_2_00DC9D74

Compliance

Uses 32bit PE files

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 212.102.56.179:443 -> 192.168.2.4:49743 version: TLS 1.0

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 156.146.33.140:443 -> 192.168.2.4:49735 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: AdGuard.Utils.Base.pdb source: setup.exe, setup.exe, 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: AdGuard.Utils.pdb source: setup.exe, setup.exe, 00000005.00000002.2938282239.0000000006C32000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.5.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb source: System.Data.SQLite.dll.5.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb,[ source: System.Data.SQLite.dll.5.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR11-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb source: setup.exe, setup.exe, 00000005.00000002.2933669810.000000000619C000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdb source: setup.exe, 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdb source: setup.exe, setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr
Source:	Binary string: AdGuard.Utils.UI.pdb source: setup.exe, setup.exe, 00000005.00000002.2937823185.0000000006B42000.00000002.00000001.01000000.00000013.sdmp, AdGuard.Utils.UI.dll.5.dr
Source:	Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: /_/csharp/src/Google.Protobuf/obj/Release/net45/Google.Protobuf.pdb source: Google.Protobuf.dll.5.dr
Source:	Binary string: /_/csharp/src/Google.Protobuf/obj/Release/net45/Google.Protobuf.pdbSHA256P source: Google.Protobuf.dll.5.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdbH source: setup.exe, 00000005.00000002.2933543828.0000000006142000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: setup.exe, 00000005.00000002.2946516434.000000006CD14000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdb source: setup.exe, setup.exe, 00000005.00000002.2933543828.0000000006142000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: setup.exe, 00000004.00000000.1946382295.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.2927044602.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000005.00000000.1950222343.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr
Source:	Binary string: indows\dll\System.pdb source: setup.exe, 00000005.00000002.2934943843.000000000652C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: setup.exe, setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr
Source:	Binary string: AdGuard.CrashReporter.pdbxZ source: setup.exe, 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdbSHA256 source: setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\WixStdBA.pdb source: mbapreq.dll.5.dr

Spreading

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003E9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	4_2_003E9A1D
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00413C72 FindFirstFileW,FindClose,	4_2_00413C72
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003D3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	4_2_003D3D4E
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DC9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	5_2_00DC9A1D
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DF3C72 FindFirstFileW,FindClose,	5_2_00DF3C72
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DB3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	5_2_00DB3D4E

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49734 -> 156.146.33.140:80

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: AdGuardVpn.dll.5.dr

Static PE information: Found NDIS imports: FwpmSubLayerAdd0, FwpmGetAppIdFromFileName0, FwpmFilterAdd0, FwpmFreeMemory0, FwpmEngineOpen0, FwpmTransactionBegin0, FwpmProviderAdd0, FwpmTransactionAbort0, FwpmEngineClose0, FwpmTransactionCommit0

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.setup.exe.6c30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 156.146.33.140 156.146.33.140

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: ARCEL-2US ARCEL-2US

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 212.102.56.179:443 -> 192.168.2.4:49743 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_00968E34 GetLastError,InternetOpenW,InternetOpenUrlW,HttpQueryInfoA,InternetReadFile,WriteFile,HeapFree,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,GetLastError,CloseHandle,

0_2_00968E34

Source: global traffic	HTTP traffic detected: GET /windows/installer.exe HTTP/1.1User-Agent: AdGuard VPN Web InstallerHost: static.adtidy.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /windows/installer.exe HTTP/1.1User-Agent: AdGuard VPN Web InstallerHost: static.adtidy.net
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: static.adtidy.net
Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: static.adguard.com

Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.adguard.com/FDefault
Source: setup.exe, 00000005.00000002.2933669810.0000000006172000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://api.adguard.com/uninstall.html
Source: setup.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: setup.exe, 00000004.00000000.1946382295.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.2927044602.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000005.00000000.1950222343.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: Google.Protobuf.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: Google.Protobuf.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Google.Protobuf.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: setup.exe, 00000005.00000002.2930862585.00000000040A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/AdGuardVpn.Burn;component/Resources/Colors.xamld
Source: setup.exe, 00000005.00000002.2930862585.00000000040A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/AdGuardVpn.Burn;component/Resources/Images.xamld
Source: setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: Google.Protobuf.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, BootstrapperCore.dll.5.dr, SharpRaven.dll.5.dr, mbapreq.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0R
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, SharpRaven.dll.5.dr, Google.Protobuf.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: setup.exe, setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2933669810.000000000619C000.00000002.00000001.01000000.0000000F.sdmp, setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2933669810.000000000619C000.00000002.00000001.01000000.0000000F.sdmp, setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0$
Source: setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: setup.exe, setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr	String found in binary or memory: http://sentry-dsn.invalid
Source: setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.com
Source: setup.exe, setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.com/installer.v1.0.json
Source: setup.exe, 00000005.00000002.2933543828.0000000006142000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://static.adguard.com/installer.v1.0.json=args
Source: setup.exe, 00000004.00000002.2926705446.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.2924499449.000000000026A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000003.1966253952.0000000000696000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2929083898.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe
Source: setup.exe, 00000005.00000002.2924949207.0000000000660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exeO
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: http://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exeh
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exeqwW
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adtidy.net/windows/installer.exe~Q
Source: BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: http://wixtoolset.org
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/
Source: setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: setup.exe, setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/releases/
Source: setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr	String found in binary or memory: http://wixtoolset.org/releases/SCreating
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/telemetry/v
Source: Google.Protobuf.dll.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: SharpRaven.dll.5.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: setup.exe, 00000004.00000003.1947788659.00000000002BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.2926705446.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000003.1947671938.00000000002BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.2924499449.00000000002BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2929083898.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://adguard.com
Source: setup.exe, 00000005.00000002.2924949207.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000003.1966338153.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000003.1966253952.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adguard.comJo
Source: setup.exe, 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dev.adguard.com&https://adguard.com
Source: setup.exe, 00000005.00000002.2930862585.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp, installer[1].htm.0.dr	String found in binary or memory: https://error.c.cdn77.org/
Source: Google.Protobuf.dll.5.dr	String found in binary or memory: https://github.com/protocolbuffers/protobuf.git
Source: setup.exe, 00000004.00000002.2926705446.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2929083898.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2924949207.0000000000660000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kb.adguard.com/
Source: setup.exe, 00000004.00000002.2924499449.000000000026A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kb.adguard.com/X3
Source: setup.exe, setup.exe, 00000005.00000002.2933669810.0000000006172000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://link.adtidy.info
Source: setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s10.adtidy.net:443/api/55/store/
Source: setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s10.adtidy.net:443/api/embed/error-page/
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: setup.exe, 00000005.00000002.2930862585.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adguard.com
Source: setup.exe, 00000005.00000002.2930862585.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adguard.com/installer.v1.0.json
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: https://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/windows/installer.exe9t
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/windows/installer.exeJw
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948095929.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adtidy.net/windows/installer.exey)
Source: System.Data.SQLite.dll.5.dr	String found in binary or memory: https://system.data.sqlite.org/
Source: System.Data.SQLite.dll.5.dr	String found in binary or memory: https://system.data.sqlite.org/X
Source: setup.exe, 00000005.00000002.2933669810.0000000006172000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://vpn.website.agrd.dev.https://adguard-vpn.com0https://link.adtidy.info
Source: BootstrapperCore.dll.5.dr, SharpRaven.dll.5.dr, mbapreq.dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: setup.exe, setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr	String found in binary or memory: https://www.getsentry.com
Source: setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr	String found in binary or memory: https://www.getsentry.com.
Source: setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 156.146.33.140:443 -> 192.168.2.4:49735 version: TLS 1.2

System Summary

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00965010	0_2_00965010
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00963D60	0_2_00963D60
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FC01F	4_2_003FC01F
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_004001A6	4_2_004001A6
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_0040A28E	4_2_0040A28E
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003D62CC	4_2_003D62CC
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00400461	4_2_00400461
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00402413	4_2_00402413
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00402642	4_2_00402642
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_0040E73C	4_2_0040E73C
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FF8C3	4_2_003FF8C3
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FFC35	4_2_003FFC35
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00409DE0	4_2_00409DE0
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FFEDF	4_2_003FFEDF
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003F3F71	4_2_003F3F71
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDC01F	5_2_00DDC01F
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE01A6	5_2_00DE01A6
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DB62CC	5_2_00DB62CC
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DEA28E	5_2_00DEA28E
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE0461	5_2_00DE0461
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE2413	5_2_00DE2413
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE2642	5_2_00DE2642
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DEE73C	5_2_00DEE73C
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDF8C3	5_2_00DDF8C3
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDFC35	5_2_00DDFC35
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE9DE0	5_2_00DE9DE0
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDFEDF	5_2_00DDFEDF
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DD3F71	5_2_00DD3F71
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06174198	5_2_06174198
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0E8E1	5_2_06E0E8E1
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E05483	5_2_06E05483
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0D083	5_2_06E0D083
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0EA67	5_2_06E0EA67
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E07043	5_2_06E07043
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0C722	5_2_06E0C722
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD0D880	5_2_6CD0D880
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD07117	5_2_6CD07117
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD12918	5_2_6CD12918
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD0DD2E	5_2_6CD0DD2E
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD06EE8	5_2_6CD06EE8
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_05CB2C38	5_2_05CB2C38
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_05CBD7B8	5_2_05CBD7B8
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_05CB2C28	5_2_05CB2C28
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063DC768	5_2_063DC768
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D0D90	5_2_063D0D90
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D6A50	5_2_063D6A50
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D19E8	5_2_063D19E8
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063DC758	5_2_063DC758
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D6A41	5_2_063D6A41
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E03339	5_2_06E03339
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_072F9D27	5_2_072F9D27

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll 5BC6335BC9649AF916A82965E3B55C1B693C216B4FA4D76740F2DB4616E82CD5

Found potential string decryption / allocating functions

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: String function: 00DEFFF0 appears 34 times
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: String function: 00DEFB09 appears 681 times
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: String function: 00DB2022 appears 54 times
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: String function: 00DB38BA appears 498 times
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: String function: 00DF2B5D appears 79 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00412B5D appears 81 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 0040FB09 appears 680 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 003D2022 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 0040FFF0 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 003D38BA appears 498 times

Uses 32bit PE files

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: AdGuardVpn.Burn.dll.5.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal54.troj.evad.winEXE@5/100@3/2

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003D2078 FormatMessageW,GetLastError,LocalFree,

4_2_003D2078

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003D4639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		4_2_003D4639
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DB4639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		5_2_00DB4639

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_004128BD GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

4_2_004128BD

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_00969998 GetModuleHandleW,FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_00969998

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003F68EE ChangeServiceConfigW,GetLastError,

4_2_003F68EE

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].htm

Jump to behavior

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Mutant created: NULL
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\AdguardVpnInstaller_F23CB6CB-327E-4BB5-B9DF-7062501506B8
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\AdguardVpnBurn_UI_F23CB6CB-C5F8-47BA-B854-DB660C1500BB

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

File created: C:\Users\user\AppData\Local\Temp\adguard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: cabinet.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: msi.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: version.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: wininet.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: comres.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: clbcatq.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: msasn1.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: crypt32.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: feclient.dll	4_2_003D1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: cabinet.dll	4_2_003D1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: cabinet.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: msi.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: version.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: wininet.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: comres.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: clbcatq.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: msasn1.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: crypt32.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: feclient.dll	5_2_00DB1070
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Command line argument: cabinet.dll	5_2_00DB1070

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [__preferences] ( [key] TEXT NOT NULL, [type] TEXT NOT NULL, [value] >, PRIMARY KEY ([key], [type]));x@{0}({1} {2} Autoincrement={3} NullValue={4} StartValue={5})\|Cannot build this statement for table without primary key for
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table' AND name='__preferences';LPreference table exists, doing nothingdThe database schema has been successfully verified

Source: setup.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: setup.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: setup.exe	String found in binary or memory: http://static.adguard.com/installer.v1.0.json
Source: setup.exe	String found in binary or memory: /reinstall
Source: setup.exe	String found in binary or memory: views/installprogress.baml
Source: setup.exe	String found in binary or memory: views/installsetting.baml
Source: setup.exe	String found in binary or memory: /AdGuardVpn.Burn;component/views/installprogress.xaml
Source: setup.exe	String found in binary or memory: /AdGuardVpn.Burn;component/views/installsetting.xaml
Source: setup.exe	String found in binary or memory: t in-addr.arpa in-the-band.net in.na in.net in.rs in.th in.ua in.us ina.ibaraki.jp ina.nagano.jp ina.saitama.jp inabe.mie.jp inagawa.hyogo.jp inagi.tokyo.jp inami.toyama.jp inami.wakayama.jp inashiki.ibaraki.jp inatsuki.fukuoka.jp inawashiro
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: https_url https://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: http_url http://static.adtidy.net/windows/installer.exe
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	String found in binary or memory: A`~@https_url https://static.adtidy.net/windows/installer.exe

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe "C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Process created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Process created: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe "C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=700 -burn.filehandle.self=708 AID=18672
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Process created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Process created: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe "C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=700 -burn.filehandle.self=708 AID=18672	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: AdGuard.Utils.Base.pdb source: setup.exe, setup.exe, 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: AdGuard.Utils.pdb source: setup.exe, setup.exe, 00000005.00000002.2938282239.0000000006C32000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb source: System.Runtime.InteropServices.RuntimeInformation.dll.5.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb source: System.Data.SQLite.dll.5.dr
Source:	Binary string: c:\dev\sqlite\dotnet\obj\2012\System.Data.SQLite.2012\Release\System.Data.SQLite.pdb,[ source: System.Data.SQLite.dll.5.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR11-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb source: setup.exe, setup.exe, 00000005.00000002.2933669810.000000000619C000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdb source: setup.exe, 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdb source: setup.exe, setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr
Source:	Binary string: AdGuard.Utils.UI.pdb source: setup.exe, setup.exe, 00000005.00000002.2937823185.0000000006B42000.00000002.00000001.01000000.00000013.sdmp, AdGuard.Utils.UI.dll.5.dr
Source:	Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: /_/csharp/src/Google.Protobuf/obj/Release/net45/Google.Protobuf.pdb source: Google.Protobuf.dll.5.dr
Source:	Binary string: /_/csharp/src/Google.Protobuf/obj/Release/net45/Google.Protobuf.pdbSHA256P source: Google.Protobuf.dll.5.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdbH source: setup.exe, 00000005.00000002.2933543828.0000000006142000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: setup.exe, 00000005.00000002.2946516434.000000006CD14000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdb source: setup.exe, setup.exe, 00000005.00000002.2933543828.0000000006142000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: setup.exe, 00000004.00000000.1946382295.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.2927044602.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000005.00000000.1950222343.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr
Source:	Binary string: indows\dll\System.pdb source: setup.exe, 00000005.00000002.2934943843.000000000652C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: setup.exe, setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr
Source:	Binary string: AdGuard.CrashReporter.pdbxZ source: setup.exe, 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdbSHA256 source: setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\WixStdBA.pdb source: mbapreq.dll.5.dr

Data Obfuscation

Binary contains a suspicious time stamp

Source: AdGuardVpn.Burn.dll.5.dr

Static PE information: 0x8239DF2F [Sun Mar 27 09:26:07 2039 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_009614F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009614F0

PE file contains sections with non-standard names

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Static PE information: section name: .eh_fram
Source: installer[1].exe.0.dr	Static PE information: section name: .wixburn
Source: setup.exe.0.dr	Static PE information: section name: .wixburn
Source: setup.exe.4.dr	Static PE information: section name: .wixburn
Source: AdGuardVpn.dll.5.dr	Static PE information: section name: .detourc
Source: AdGuardVpn.dll.5.dr	Static PE information: section name: .detourd

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00969998 push edx; mov dword ptr [esp], eax	0_2_009699FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0096B55C push eax; mov dword ptr [esp], ebx	0_2_0096B597
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00968170 push ecx; mov dword ptr [esp], ebx	0_2_009688F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00968170 push eax; mov dword ptr [esp], ebx	0_2_00968947
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0096B6A8 push ecx; mov dword ptr [esp], eax	0_2_0096BA6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0096B6A8 push ebx; mov dword ptr [esp], 00000005h	0_2_0096BE95
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0096B6A8 push edx; mov dword ptr [esp], eax	0_2_0096BF78
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00968E34 push edx; mov dword ptr [esp], edi	0_2_009690EE
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0096F8E2 push ecx; ret	0_2_0096F8E3
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FE806 push ecx; ret	4_2_003FE819
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDE806 push ecx; ret	5_2_00DDE819
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06143AEF push es; retf 0000h	5_2_06143B0A
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06143BCF push es; iretd	5_2_06143BEA
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_0614498D push es; retf	5_2_061449B2
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06B473F3 push es; iretd	5_2_06B473FB
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06B46907 push ss; retf	5_2_06B46914
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06C33A5D push es; ret	5_2_06C33A63
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0E5ED push cs; retf	5_2_06E0E5F0
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0DFA9 push es; retf	5_2_06E0E164
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0E14D push es; retf	5_2_06E0E164
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0EA5F push ss; retf	5_2_06E0EA64
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E0E625 push cs; retf	5_2_06E0E626
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_06E87A54 pushfd ; ret	5_2_06E87A55
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD04476 push ecx; ret	5_2_6CD04489
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_05CB6CE8 push edx; ret	5_2_05CB6CEB
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D5630 push edx; iretd	5_2_063D5633
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D5765 push es; ret	5_2_063D5838
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D57E0 push es; ret	5_2_063D5838
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063DFD44 push dword ptr [ebp+34h]; mov dword ptr [esp], eax	5_2_063DFD48
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_063D8DCA push es; ret	5_2_063D8DD0

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	File created: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	File created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\installer[1].exe	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	File created: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	File created: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Memory allocated: 3B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Memory allocated: 3960000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86400000	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399843	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399687	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399578	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399468	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399359	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399249	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399140	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399031	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398921	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398812	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398702	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398593	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398484	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398375	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398265	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398156	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398046	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397937	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397828	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397718	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397607	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397498	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397390	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397279	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397171	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397005	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396851	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396734	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396625	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396513	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396406	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396296	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396187	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396078	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395968	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395859	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395750	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395640	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395531	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395421	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395312	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395203	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599298	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Window / User API: threadDelayed 2735			Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Window / User API: threadDelayed 7095			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Google.Protobuf.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Found evasive API chain checking for process token information

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

API coverage: 9.2 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86400000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399843s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399687s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399578s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399468s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399359s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399249s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399140s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86399031s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398921s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398812s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398702s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398593s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398484s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398375s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398265s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398156s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86398046s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397937s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397828s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397718s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397607s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397498s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397390s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397279s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397171s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86397005s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396851s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396734s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396625s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396513s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396406s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396296s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396187s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86396078s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395968s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395859s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395750s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395640s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395531s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395421s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395312s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -86395203s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -599641s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -599422s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe TID: 6528	Thread sleep time: -599298s >= -30000s	Jump to behavior

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_0040F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0040F839h	4_2_0040F79E
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_0040F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0040F832h	4_2_0040F79E
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DEF79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00DEF839h	5_2_00DEF79E
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DEF79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00DEF832h	5_2_00DEF79E

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003E9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	4_2_003E9A1D
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00413C72 FindFirstFileW,FindClose,	4_2_00413C72
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003D3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	4_2_003D3D4E
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DC9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	5_2_00DC9A1D
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DF3C72 FindFirstFileW,FindClose,	5_2_00DF3C72
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DB3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	5_2_00DB3D4E

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_00418EF4 VirtualQuery,GetSystemInfo,

4_2_00418EF4

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86400000	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399843	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399687	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399578	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399468	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399359	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399249	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399140	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86399031	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398921	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398812	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398702	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398593	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398484	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398375	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398265	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398156	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86398046	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397937	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397828	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397718	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397607	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397498	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397390	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397279	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397171	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86397005	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396851	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396734	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396625	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396513	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396406	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396296	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396187	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86396078	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395968	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395859	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395750	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395640	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395531	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395421	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395312	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 86395203	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599422	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Thread delayed: delay time: 599298	Jump to behavior

Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: setup.exe.0.dr	Binary or memory string: HgFsx
Source: setup.exe, 00000005.00000002.2934943843.0000000006500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll1
Source: SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948309858.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.exe.0.dr	Binary or memory string: /DaMQemuU

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_004034A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_004034A2

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_009614F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_009614F0

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_00404104 mov eax, dword ptr fs:[00000030h]	4_2_00404104
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE4104 mov eax, dword ptr fs:[00000030h]	5_2_00DE4104
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD08FD6 mov eax, dword ptr fs:[00000030h]	5_2_6CD08FD6

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: 0_2_00968170 GetProcessHeap,strlen,HeapAlloc,memchr,memchr,memchr,memchr,HeapAlloc,HeapFree,GetLastError,HeapAlloc,GdiplusStartup,GetCurrentThreadId,GetDC,GetDeviceCaps,ReleaseDC,SystemParametersInfoW,GetModuleHandleW,LoadIconW,LoadCursorW,RegisterClassExW,SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,SetWindowLongW,KiUserCallbackDispatcher,ShowWindow,GetLastError,CreateThread,KiUserCallbackDispatcher,GetParent,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,WaitForSingleObject,GetExitCodeThread,CloseHandle,DeleteObject,DeleteObject,DeleteObject,GdiplusShutdown,GetModuleHandleW,UnregisterClassW,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,

0_2_00968170

Enables debug privileges

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_0096117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_0096117C
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_009611B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_009611B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_00961170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00961170
Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	Code function: 0_2_009613D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_009613D1
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FE0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_003FE0A8
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_004034A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004034A2
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FE574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_003FE574
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 4_2_003FE707 SetUnhandledExceptionFilter,	4_2_003FE707
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDE0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00DDE0A8
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DE34A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00DE34A2
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDE574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00DDE574
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_00DDE707 SetUnhandledExceptionFilter,	5_2_00DDE707
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD0448C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6CD0448C
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD042B6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6CD042B6
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Code function: 5_2_6CD07F77 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6CD07F77

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Process created: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe "C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=700 -burn.filehandle.self=708 AID=18672

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_00410FA6 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

4_2_00410FA6

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_004132B9 AllocateAndInitializeSid,CheckTokenMembership,

4_2_004132B9

Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003FE937 cpuid

4_2_003FE937

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Code function: GetLocaleInfoW,GetWindowLongW,SetWindowLongW,ShowWindow,SendMessageW,SendMessageW,SendMessageW,CreateFontIndirectW,CreateSolidBrush,LoadImageW,SendMessageW,ShowWindow,ShowWindow,strlen,ShowWindow,LoadCursorW,SetWindowLongW,CreateFontIndirectW,SendMessageW,strlen,ShowWindow,

0_2_009693D8

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Installer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\SharpRaven.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemCore\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003E4E6A ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

4_2_003E4E6A

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003D605F GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

4_2_003D605F

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003D6203 GetUserNameW,GetLastError,

4_2_003D6203

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_00418039 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

4_2_00418039

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 4_2_003D51D2 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

4_2_003D51D2

Source: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgrsx.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKService.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dwservice.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKProxy.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKTray.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dwengine.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgui.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ufnavi.exe
Source: setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: mbam.exe

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 5.2.setup.exe.6e80000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.setup.exe.63f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.setup.exe.6b40000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.setup.exe.6c30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2937823185.0000000006B42000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2938282239.0000000006C32000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll, type: DROPPED

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 5.2.setup.exe.6e80000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.setup.exe.63f0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.setup.exe.6b40000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.setup.exe.6c30000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2937823185.0000000006B42000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2938282239.0000000006C32000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Network Sniffing	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	13 Process Injection	1 Timestomp	NTDS	1 Network Sniffing	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	35 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	31 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	13 Process Injection	/etc/passwd and /etc/shadow	31 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	0%	ReversingLabs
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\installer[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	0%	ReversingLabs
C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Installer.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Google.Protobuf.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\SharpRaven.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Data.SQLite.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ar\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\be\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\bg\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\cs\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\da\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\de\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\es\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fa\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\he\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hu\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hy\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\id\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\it\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ja\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ko\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbahost.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\nl\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\no\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pl\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ro\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ru\AdGuardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sl\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\tr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\uk\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\vi\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh\AdguardVpn.Burn.resources.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
1523296349.rsc.cdn77.org	0%	Virustotal	Browse
1625341327.rsc.cdn77.org	0%	Virustotal	Browse
static.adguard.com	0%	Virustotal	Browse
static.adtidy.net	1%	Virustotal	Browse
time.windows.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Avira URL Cloud	safe
https://system.data.sqlite.org/X	0%	Avira URL Cloud	safe
http://wixtoolset.org/news/	0%	Avira URL Cloud	safe
http://api.adguard.com/uninstall.html	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	Virustotal		Browse
http://api.adguard.com/uninstall.html	0%	Virustotal		Browse
http://wixtoolset.org/news/	0%	Virustotal		Browse
https://system.data.sqlite.org/X	0%	Virustotal		Browse
https://github.com/protocolbuffers/protobuf.git	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exe~Q	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	Virustotal		Browse
http://wixtoolset.org/releases/SCreating	0%	Avira URL Cloud	safe
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	0%	Avira URL Cloud	safe
http://static.adtidy.net/windows/installer.exeqwW	0%	Avira URL Cloud	safe
http://defaultcontainer/AdGuardVpn.Burn;component/Resources/Colors.xamld	0%	Avira URL Cloud	safe
https://kb.adguard.com/X3	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsynapplicationc:	0%	Avira URL Cloud	safe
http://wixtoolset.org	0%	Avira URL Cloud	safe
https://github.com/protocolbuffers/protobuf.git	0%	Virustotal		Browse
https://link.adtidy.info	0%	Avira URL Cloud	safe
http://static.adguard.com/installer.v1.0.json=args	0%	Avira URL Cloud	safe
http://wixtoolset.org/releases/SCreating	0%	Virustotal		Browse
http://appsyndication.org/2006/appsynapplicationc:	0%	Virustotal		Browse
https://s10.adtidy.net:443/api/55/store/	0%	Avira URL Cloud	safe
http://wixtoolset.org	0%	Virustotal		Browse
https://static.adguard.com	0%	Avira URL Cloud	safe
http://static.adguard.com/installer.v1.0.json=args	0%	Virustotal		Browse
http://static.adguard.com/installer.v1.0.json	0%	Avira URL Cloud	safe
https://www.getsentry.com.	0%	Avira URL Cloud	safe
https://static.adguard.com	0%	Virustotal		Browse
http://defaultcontainer/AdGuardVpn.Burn;component/Resources/Images.xamld	0%	Avira URL Cloud	safe
https://s10.adtidy.net:443/api/55/store/	0%	Virustotal		Browse
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	1%	Virustotal		Browse
https://dev.adguard.com&https://adguard.com	0%	Avira URL Cloud	safe
https://www.getsentry.com.	0%	Virustotal		Browse
http://static.adguard.com/installer.v1.0.json	0%	Virustotal		Browse
https://static.adtidy.net/	0%	Avira URL Cloud	safe
https://static.adtidy.net/windows/installer.exeJw	0%	Avira URL Cloud	safe
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	0%	Avira URL Cloud	safe
https://error.c.cdn77.org/	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Avira URL Cloud	safe
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exeO	0%	Avira URL Cloud	safe
https://static.adtidy.net/	1%	Virustotal		Browse
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	0%	Virustotal		Browse
http://static.adguard.com	0%	Avira URL Cloud	safe
http://static.adguard.com	0%	Virustotal		Browse
http://james.newtonking.com/projects/json	0%	Avira URL Cloud	safe
https://kb.adguard.com/	0%	Avira URL Cloud	safe
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exeO	0%	Virustotal		Browse
https://error.c.cdn77.org/	0%	Virustotal		Browse
https://link.adtidy.info	0%	Virustotal		Browse
http://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
https://vpn.website.agrd.dev.https://adguard-vpn.com0https://link.adtidy.info	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Virustotal		Browse
http://james.newtonking.com/projects/json	0%	Virustotal		Browse
http://wixtoolset.org/releases/	0%	Avira URL Cloud	safe
http://sentry-dsn.invalid	0%	Avira URL Cloud	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Avira URL Cloud	safe
https://kb.adguard.com/	0%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exeh	0%	Avira URL Cloud	safe
https://www.getsentry.com	0%	Avira URL Cloud	safe
https://adguard.comJo	0%	Avira URL Cloud	safe
http://wixtoolset.org/releases/	0%	Virustotal		Browse
http://static.adtidy.net/windows/installer.exe	100%	Avira URL Cloud	malware
https://static.adtidy.net/windows/installer.exey)	0%	Avira URL Cloud	safe
http://wixtoolset.org/	0%	Avira URL Cloud	safe
http://wixtoolset.org/telemetry/v	0%	Avira URL Cloud	safe
https://www.nuget.org/packages/Newtonsoft.Json.Bson	0%	Avira URL Cloud	safe
https://static.adguard.com/installer.v1.0.json	0%	Avira URL Cloud	safe
http://www.newtonsoft.com/jsonschema	0%	Virustotal		Browse
https://adguard.com	0%	Avira URL Cloud	safe
https://system.data.sqlite.org/	0%	Avira URL Cloud	safe
https://static.adtidy.net/windows/installer.exe9t	0%	Avira URL Cloud	safe
https://static.adtidy.net/windows/installer.exe	100%	Avira URL Cloud	malware
https://s10.adtidy.net:443/api/embed/error-page/	0%	Avira URL Cloud	safe
http://api.adguard.com/FDefault	0%	Avira URL Cloud	safe
http://appsyndication.org/2006/appsyn	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
1523296349.rsc.cdn77.org	156.146.33.140	true	true	0%, Virustotal, Browse	unknown
1625341327.rsc.cdn77.org	212.102.56.179	true	false	0%, Virustotal, Browse	unknown
static.adtidy.net	unknown	unknown	false	1%, Virustotal, Browse	unknown
static.adguard.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://static.adguard.com/installer.v1.0.json	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adguard.com/installer.v1.0.json	false	Avira URL Cloud: safe	unknown
https://static.adtidy.net/windows/installer.exe	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.adguard.com/uninstall.html	setup.exe, 00000005.00000002.2933669810.0000000006172000.00000002.00000001.01000000.0000000F.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://system.data.sqlite.org/X	System.Data.SQLite.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/news/	setup.exe, setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exe~Q	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/protocolbuffers/protobuf.git	Google.Protobuf.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/releases/SCreating	setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	setup.exe, 00000004.00000002.2926705446.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000002.2924499449.000000000026A000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000003.1966253952.0000000000696000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2929083898.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exeqwW	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/AdGuardVpn.Burn;component/Resources/Colors.xamld	setup.exe, 00000005.00000002.2930862585.00000000040A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kb.adguard.com/X3	setup.exe, 00000004.00000002.2924499449.000000000026A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsynapplicationc:	setup.exe, 00000004.00000000.1946382295.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000005.00000002.2927044602.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000005.00000000.1950222343.0000000000DFA000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org	BootstrapperCore.dll.5.dr, mbapreq.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://link.adtidy.info	setup.exe, setup.exe, 00000005.00000002.2933669810.0000000006172000.00000002.00000001.01000000.0000000F.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.com/installer.v1.0.json=args	setup.exe, 00000005.00000002.2933543828.0000000006142000.00000002.00000001.01000000.00000010.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://s10.adtidy.net:443/api/55/store/	setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adguard.com	setup.exe, 00000005.00000002.2930862585.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.getsentry.com.	setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://defaultcontainer/AdGuardVpn.Burn;component/Resources/Images.xamld	setup.exe, 00000005.00000002.2930862585.00000000040A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.adguard.com&https://adguard.com	setup.exe, 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	unknown
https://static.adtidy.net/	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000D0D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adtidy.net/windows/installer.exeJw	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	setup.exe, 00000005.00000002.2932925138.0000000005D22000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://error.c.cdn77.org/	setup.exe, 00000005.00000002.2930862585.0000000003CDC000.00000004.00000800.00020000.00000000.sdmp, installer[1].htm.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exeO	setup.exe, 00000005.00000002.2924949207.0000000000660000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.com	setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://james.newtonking.com/projects/json	setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kb.adguard.com/	setup.exe, 00000004.00000002.2926705446.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2929083898.0000000002B10000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2924949207.0000000000660000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.newtonsoft.com/jsonschema	setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vpn.website.agrd.dev.https://adguard-vpn.com0https://link.adtidy.info	setup.exe, 00000005.00000002.2933669810.0000000006172000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/releases/	setup.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sentry-dsn.invalid	setup.exe, setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, AdGuard.Utils.UI.dll.5.dr, setup.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exeh	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.getsentry.com	setup.exe, setup.exe, 00000005.00000002.2938527184.0000000006E02000.00000002.00000001.01000000.00000015.sdmp, SharpRaven.dll.5.dr	false	Avira URL Cloud: safe	unknown
https://adguard.comJo	setup.exe, 00000005.00000002.2924949207.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000003.1966338153.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000003.1966253952.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://static.adtidy.net/windows/installer.exe	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe	false	Avira URL Cloud: malware	unknown
https://static.adtidy.net/windows/installer.exey)	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948095929.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/	setup.exe	false	Avira URL Cloud: safe	unknown
http://wixtoolset.org/telemetry/v	setup.exe	false	Avira URL Cloud: safe	unknown
https://www.nuget.org/packages/Newtonsoft.Json.Bson	setup.exe, 00000005.00000002.2939989534.00000000072F2000.00000002.00000001.01000000.00000016.sdmp	false	Avira URL Cloud: safe	unknown
https://adguard.com	setup.exe, 00000004.00000003.1947788659.00000000002BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.2926705446.0000000002B30000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000004.00000003.1947671938.00000000002BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000004.00000002.2924499449.00000000002BC000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000005.00000002.2929083898.0000000002B10000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://system.data.sqlite.org/	System.Data.SQLite.dll.5.dr	false	Avira URL Cloud: safe	unknown
https://static.adtidy.net/windows/installer.exe9t	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1947191744.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000002.1948254158.0000000000CE6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe, 00000000.00000003.1936236143.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://s10.adtidy.net:443/api/embed/error-page/	setup.exe, 00000005.00000002.2930862585.0000000003BFF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.adguard.com/FDefault	setup.exe, 00000005.00000002.2930862585.0000000003CFA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsyn	setup.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
212.102.56.179	1625341327.rsc.cdn77.org	Italy		60068	CDN77GB	false
156.146.33.140	1523296349.rsc.cdn77.org	United States		3743	ARCEL-2US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1461053
Start date and time:	2024-06-22 06:27:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
Detection:	MAL
Classification:	mal54.troj.evad.winEXE@5/100@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 142 Number of non-executed functions: 284
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 40.119.148.38
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:28:27	API Interceptor	793172x Sleep call for process: setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
212.102.56.179	https://dutchpopp.com	Get hash	malicious	Unknown	Browse
212.102.56.179	https://interface01.nsxtlmv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
156.146.33.140	http://www.walmert.com	Get hash	malicious	Unknown	Browse
	http://www.winglee.ca	Get hash	malicious	Unknown	Browse
	https://fm.solewe.com/?dl=1bf2e18efc6c3969c16b88a11bd91a04	Get hash	malicious	Unknown	Browse
	http://iyfhshsp.com/Stockyard.cfm?domain=ontariostockyards.on.ca&fp=CIJaHXP%2F0skOkNSQd%2F4jtYF3X0QXgT%2B41bUKlz9x8WIfofj6IPTV8ScBtVOQWLtb%2FRwG%2FSkHiiHeZllib976kXCJ4XMA794ZiznRS1wP5Uf04A9tPtI%2B0LoCkzGPdAHYsRq7MR7MdbFPY6oXhvApuHKBrlR32ugZAs8XzrJENmfc665HHXmTlZitcPeywgrTHI6o1222VmPYvgQj3BF3SrPGahD54P8mb7wnGA1Iq2VkMCzKYfTBs9TsEjTlKq4y0VG2Wfe4HZz%2FfV4Kj9e8srxlzEkIc8wqr0A4WlsXH8B6EYuy9GOPwGtl0mU5fDBh&yep=RVNTenhI%2BK5wtfh2y3hvr0C%2Bf8yLo0OquMvUcIDm2pI%2BazRSAc%2BgO8tqXXkadYdZm%2FCdVtUW6v4fRHfi2iLasg4ugBXXocFy%2BKZRh8tTJ%2B1hPAPyIid9TVDBqYtpHTyVkiaz87oq7ncPzsby9Tg3T2j1RIiGpW1BmK%2FTrWUih%2FXnDRKhZFMjpokW5c0YMS1fK3J7%2Bd66FySEOnk4uznr%2Bj2iXwlpK45ddD%2FQhCQdRbSYtXyK6Y%2BnNH0XmeriKJQq30PcKbP2b2rfFFjMfmciNCzMIuHsxuylX1DCXMJkN7S2Y8niXSmMcZHZ2gbvX7m%2FOujBxUYqP4pl5pesXzNvel9QWXdbhQ6U03mTXDA670%2FoRFLT8ez1b%2BRvdcfRh2IRVZ3USOJ7UUDZsD%2B4qi731tfoY%2BuT2tHsaGjnJUDy6MSUl743ntfchbV8KuCXmSn1XmeM0kBMR7GWGmgarnEPN%2Fu7tqup9nk129kApIU2XJazrgl2BHASztPoRHJA4xbNJbkTRaDBlHCK9N67TWzrLkFiJ4twAESoSeN26JeNJt6yqKEPdMZKK%2FsbdMW2QYCGWTu0y0eI792%2BqESxmSj4qA6XfdvJ79k%2Bt%2FyBpSzxK2dquDe2JW6MniZQO6CyU2DhiqKzuDQZmsRZ9m8oHVJf6beA8iYJEbjVJaqTWlmrxGQuQ3DSFeBBE8Ne7oPiiZpLqvFbXKPRcgHr9vMQnTDuCWeZqxXfyiW6CcQ3voM95JJ3tzh5utgMLxXBGHBXFS4Ixa%2B5xkoKj0z7EcOCMx8YiIPVZV4lNs46zB9oqP6jlu0MJAe0pYCGsL8uwTsCVWoXahV%2Fu8JKPadX1ikQgHDyF9%2BcBGvs%2FbzL7vuCdqOfmzHcvExkDQgErBb%2BBtNCNp%2B%2FWqR%2F0cmKe6xi8aBCM7qXGm9cEPpsSqr%2BUuXrF193vXut6QHyCd5IqK1XfStY9gWk7QIiMjNxV8zcI%2FXxHJzeFzAjtmoqhbv4cIOJbt8Na7zCDyqKk48L1UnuTJqozjuhQ8WSTcNUOw%2B88xJFzzj95RXpBCr2YLtw6JWH8LGB9MnYKzgGed%2B%2F2vh7SMj%2FO%2FGwwIYOzl3ObdsRSKRFiuUKJqDDT93kK1kj4kEZap5RR9jN6EErfJGTODOigOlaeC1li6Vkvd4gGLQ%2B0HboZ1yg1huBq3K6KvalppsbOoowIz7KG9DqWOJX8hCeGv9dgx9in43hGAWlPGAeuTIqH1boNtj9V3sYVooX5WKblP6tqk3kwvWKmKQOG8vtPGqF5k5Fu4FYO7VSCSzcZoMsDuO2NgJXtvtrFv2D%2FUL%2FeQWWBRqTbSAlLtN%2FMaxEHYMn8Gh%2FJUJ0BoFknnzE9rvJSVjZPOF9mWaZ5JUpoLmRcFBiOVduKCDx5GiDppZF7oI32XfhBbpQYJKIoXaSuCLE%2BUlgzBN8eV4RUkpSDfiZWEL0ePYtSC9bG1YPOZQrRvsZSXYnczNPInescpPN59yK9vXTcATqofw2juvQf	Get hash	malicious	Unknown	Browse
	http://cdn.camvenue.live	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwj85-Cx0Pz-AhV5FVkFHezeDZcQFnoECCUQAQ&url=https%3A%2F%2Fwww.dltk-teach.com%2Frhymes%2Fmacdonald%2Fmlyrics.htm&usg=AOvVaw0mYQOAG6hFsIBU_fVcAryo	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1523296349.rsc.cdn77.org	__.exe	Get hash	malicious	PureLog Stealer	Browse	195.181.175.40
	__.exe	Get hash	malicious	PureLog Stealer	Browse	195.181.175.40
	TsU2RShnl7.exe	Get hash	malicious	PureLog Stealer	Browse	156.146.36.23
1625341327.rsc.cdn77.org	__.exe	Get hash	malicious	PureLog Stealer	Browse	156.146.33.15
	__.exe	Get hash	malicious	PureLog Stealer	Browse	195.181.170.18
	TsU2RShnl7.exe	Get hash	malicious	PureLog Stealer	Browse	156.146.36.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDN77GB	Complete with Docusign chelsea.pdf	Get hash	malicious	Unknown	Browse	195.181.175.40
	https://ipfs.io/ipfs/QmZ1uhxgG3izsY4KucbZqswPgFWzecvF4LdbKLjXvQGnuB	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://u2939254.ct.sendgrid.net/ls/click?upn=u001.TKkwJSV9-2Fws5TpW3RQYs99-2FBeVmlunHf0-2F0CNCHqilOzq-2FQpvRNOxYwhUCotajdtwjCOFaYozqKxQhX3g0Kizaz7Ru-2Fk-2BlOd-2F1uK-2BpGDXCaTK-2B6z7qKyUi9woDQPY-2FYUM0znDc4drOXLxEnjLiSwuelV-2FcqhQ9mNXyE3xT-2BrXiA-3DA0a2_h5tndX3XP82u2CVP7HmVo-2BgFxiBMXo9LX8o14HIIdhsriIms-2FUknD2cTodKM-2FG-2BB9ZTfUIQeE84DwPuu-2BAGswZMh5IWYH7OqErdwsWz0turUA5IBflIOJpCg6Fr42WxbThk2nslgtkkmPKHYXH9XoaCJns8LSyquGX2eO-2FsQnWJ-2BoOQAlHUReelXX-2FXslzAQzPE5mOJZ-2BwAn0YnlEjzIwQ-3D-3D	Get hash	malicious	Unknown	Browse	185.93.1.244
	http://bafybeih5dsh26i36hhp5qj33lwgon7pkgoaeqnfk7tj5et7nfapgzeztzu.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	185.93.3.244
	https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379	Get hash	malicious	Unknown	Browse	212.102.56.178
	https://ipfs.io/ipfs/bafybeighp4krlvehs33pimsa3ka7aimkt3miqblm5arwkobl432i3aysgq/WeTransfer%20domain.html/	Get hash	malicious	HTMLPhisher	Browse	185.93.3.244
	https://rb.gy/s9lzwt	Get hash	malicious	Unknown	Browse	185.93.3.244
	https://giantscreening.onlinesacs.com/refereeportal/02000000F85F4B85FCB47421E548FF6F74DE3F0CA330D6F27E705AEA99C493357AE61A9AD2C3AE435C2ED0D2569E30B1D90DD981	Get hash	malicious	Unknown	Browse	212.102.56.178
	Setup (1).exe	Get hash	malicious	Unknown	Browse	195.181.170.19
	https://dutchpopp.com	Get hash	malicious	Unknown	Browse	212.102.56.178
ARCEL-2US	arm4.elf	Get hash	malicious	Mirai	Browse	156.144.159.185
	ATT001_PlayVM.html	Get hash	malicious	Unknown	Browse	156.146.33.15
	https://mg1bfngm.r.us-west-2.awstrack.me/L0/https:%2F%2Frevvitysignals.flexnetoperations.com/1/010101902cdaddd1-d5baf378-d6a1-494e-93fe-7e5b5c9ac2af-000000/Z7a4stK-RPA_fgx2tetLRX9SKSU=379	Get hash	malicious	Unknown	Browse	156.146.33.141
	https://web.streamlinevrs.com/pmt_common/redirect/email_292045603.script?url=//lzKmqliM.ortopediajk.com.br/godsendd/	Get hash	malicious	Unknown	Browse	156.146.33.138
	https://giantscreening.onlinesacs.com/refereeportal/02000000F85F4B85FCB47421E548FF6F74DE3F0CA330D6F27E705AEA99C493357AE61A9AD2C3AE435C2ED0D2569E30B1D90DD981	Get hash	malicious	Unknown	Browse	156.146.33.138
	Setup (1).exe	Get hash	malicious	Unknown	Browse	156.146.33.138
	https://pikara-campaign.com/st-manager/click/track?id=300&type=classic&url=https://melaminafatima.com/antibot%23Aminor%2Bccfi.com&source_url=https%3A%2F%2Fpikara-campaign.com%2Fnext%2F&source_title=%E3%83%94%E3%82%AB%E3%83%A9%E5%85%89%E3%81%AD%E3%81%A3%E3%81%A8%20%E3%81%8A%E3%81%99%E3%81%99%E3%82%81%20%E4%BB%A3%E7%90%86%E5%BA%97%E3%80%8C%E6%A0%AA%E5%BC%8F%E4%BC%9A%E7%A4%BENEXT%E3%80%8D%E3%81%AE%E3%82%AD%E3%83%A3%E3%83%83%E3%82%B7%E3%83%A5%E3%83%90%E3%83%83%E3%82%AF%E3%82%AD%E3%83%A3%E3%83%B3%E3%83%9A%E3%83%BC%E3%83%B3%EF%BC%BB%E6%9C%80%E6%96%B0%E6%83%85%E5%A0%B1%3A%202024%E5%B9%B46%E6%9C%883%E6%97%A5%28%E6%9C%88%29%EF%BC%BD	Get hash	malicious	HTMLPhisher	Browse	156.146.33.14
	Updated contract doc.one	Get hash	malicious	HTMLPhisher	Browse	156.146.33.14
	BWzZ0rQSWQ.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.146.78.53
	hj3msRLZgi.elf	Get hash	malicious	Mirai, Gafgyt	Browse	156.144.247.152

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Kf1Rr6jArf.exe	Get hash	malicious	Phemedrone Stealer	Browse	212.102.56.179
	INQUIRY.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	212.102.56.179
	Data-Sheet.js	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	212.102.56.179
	z26SZO98764590000000980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	212.102.56.179
	oTfjRHJdWzffhcnPGd.exe	Get hash	malicious	AgentTesla	Browse	212.102.56.179
	MT Sea Gull 9 Particulars.exe	Get hash	malicious	Snake Keylogger	Browse	212.102.56.179
	E9231UlgL8.exe	Get hash	malicious	Xehook Stealer	Browse	212.102.56.179
	E9231UlgL8.exe	Get hash	malicious	Xehook Stealer	Browse	212.102.56.179
	ESItm2CpzS.exe	Get hash	malicious	Xehook Stealer	Browse	212.102.56.179
	Order Inquiry.vbs	Get hash	malicious	PXRECVOWEIWOEI Stealer	Browse	212.102.56.179
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Trojan.Siggen16.24785.7080.9620.exe	Get hash	malicious	Unknown	Browse	156.146.33.140
	SecuriteInfo.com.Trojan.Siggen16.24785.7080.9620.exe	Get hash	malicious	Unknown	Browse	156.146.33.140
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	156.146.33.140
	Setup.exe	Get hash	malicious	Vidar	Browse	156.146.33.140
	SecuriteInfo.com.Win64.MalwareX-gen.18256.27985.exe	Get hash	malicious	Unknown	Browse	156.146.33.140
	SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll	Get hash	malicious	Unknown	Browse	156.146.33.140
	SecuriteInfo.com.Win32.AdwareX-gen.24897.26461.dll	Get hash	malicious	Unknown	Browse	156.146.33.140
	file.exe	Get hash	malicious	Vidar	Browse	156.146.33.140
	decrypted.exe	Get hash	malicious	Vidar	Browse	156.146.33.140
	SKMB June 20 2024.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	156.146.33.140

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\installer[1].exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	__.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll	__.exe	Get hash	malicious	PureLog Stealer	Browse
	__.exe	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].htm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	777
Entropy (8bit):	4.815544866815673
Encrypted:	false
SSDEEP:	12:hSn2O6Qclfhxts9FQ60hFP4xs4uXRLdJpQNVly/tb:hSfspxts9qHbBXRhnQNVWR
MD5:	01E3AA88E44D1AF26E5E72E37789700F
SHA1:	42DC835234D93A0FA06840FD1B503D163F2884E2
SHA-256:	F9FE349F77B616337B4DD30016151B9D017C4C9B28581CB96C336A3E5649FB6E
SHA-512:	79F502DBF0056B3372CAB28350592ACA30A455CC1C250466F845508F211F036003E1502468001C5770611694876D22B57143ED9CA9E789F2B4071BCD8DC1243C
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<head>. <base href="https://error.c.cdn77.org/" target="_blank">. <meta http-equiv="Content-Type" content="text/html; charset=utf-8">. <meta name="author" content="(c) 2023 CDN77">. <meta name="viewport" content="width=device-width, initial-scale=1">. <link rel="stylesheet" href="css/main.css">. <link rel="shortcut icon" href="img/favicon.ico" />.. <title>Moved Permanently</title>.</head>.<body style="background-color: #0d5284; color: #fff;" class="Header-wrap">. <h1>. <small class="Header-errorNumber">. 301 Redirect</small><br>. Moved Permanently. </h1>. <p class="Header-desc-description">. This resource has been permanently moved to a new location.</p>.</body>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\installer[1].exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33343848
Entropy (8bit):	7.99712793939824
Encrypted:	true
SSDEEP:	786432:XHnNMV7aaAYes29D4EDzuwWJYXoJPYaKFphuSDe:3nKV7aPZiEDzuwWJY4Jwdrhu3
MD5:	B005E4007EB93F23BB0E7F03FB634D46
SHA1:	2DDD20CC6B44752BAA19A8C871233ADE7F27BBFC
SHA-256:	0CB50652E644A2DBA3B47BF2D55ACDD27CE1007286B37E615C6C7C115BA0A4EA
SHA-512:	992DBA117A2E7076BE418537C09B4028089F4DF3E2F2723C7EA91E96EFAA3246A062C8A399E5209BA8B1497FE0B1B4B64308F9EC9BEE924EC06949990882C366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@.................................h.....@.............................................T................,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AdguardVPN\AdguardVPN_20240622002825.log

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	ASCII text, with very long lines (308), with CRLF line terminators
Category:	dropped
Size (bytes):	15628
Entropy (8bit):	5.3859652141969265
Encrypted:	false
SSDEEP:	96:0tKuKt+eqFso3d9u8yBiOFDeidELDpGkGTGvGowzh0Gg+yLRc/bTnMQMQMQMQMYt:JV+PFd3d9sByJGzNKiDQffffYt
MD5:	8B8167EABD3AAF067E39B8BFE3909A94
SHA1:	B3F9EAF7733EC6F957245DA0CAA140B3DA31C3A2
SHA-256:	299B96162BE848165A370E021D587C06FCFB625EBCCBE9F86682AF135BDC720B
SHA-512:	C40025B6B7A8C519E7F0727FB8BAF1D232E2C6D32BBFBCAF8F3B920DD4FE4673746463C96A5BA17E1A56CC697CD1AF91917F1CDC00A04E1B3596A0126A3261A3
Malicious:	false
Reputation:	low
Preview:	[1780:0B50][2024-06-22T00:28:24]i001: Burn v3.11.2.4516, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'AID' to value ''..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'CID' to value ''..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'REMOVE_SETTINGS' to value 'NO'..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'SHOW_UNINSTALL_PAGE' to value 'YES'..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'NORUN' to value ''..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'INSTALLDESKTOPSHORTCUT' to value ''..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'INSTALLLOCATION' to value ''..[1780:0B50][2024-06-22T00:28:24]i000: Initializing string variable 'BUNDLE_KEY' to value '[WixBundleProviderKey]'..[1780:0B50][2024-06-22T00:28:24]i000: I

C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33343848
Entropy (8bit):	7.99712793939824
Encrypted:	true
SSDEEP:	786432:XHnNMV7aaAYes29D4EDzuwWJYXoJPYaKFphuSDe:3nKV7aPZiEDzuwWJY4Jwdrhu3
MD5:	B005E4007EB93F23BB0E7F03FB634D46
SHA1:	2DDD20CC6B44752BAA19A8C871233ADE7F27BBFC
SHA-256:	0CB50652E644A2DBA3B47BF2D55ACDD27CE1007286B37E615C6C7C115BA0A4EA
SHA-512:	992DBA117A2E7076BE418537C09B4028089F4DF3E2F2723C7EA91E96EFAA3246A062C8A399E5209BA8B1497FE0B1B4B64308F9EC9BEE924EC06949990882C366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@.................................h.....@.............................................T................,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7303192
Entropy (8bit):	7.967426283225315
Encrypted:	false
SSDEEP:	98304:BT0tEi9DACSh5mX6Ars1y2+A/6VQdn0t0KoBiuYNB8Fmvm0rgI5t5yYMWd+pfSjv:BTKeqSd+E07tTuiDX8wv5r94dib
MD5:	29467FD9BE93C4AC0BA9D863AE30EDF9
SHA1:	F19CB3F6DA9DD998E0BFB7183D13CA9B592C7899
SHA-256:	EDB674894994D5CAC133ABEC9E5E2ECE8560DC8BCC70A3BF94D341C87A15E8E2
SHA-512:	164AFBA38BDDD8411800886DF66599DB53EE979D4320BD9B986F716F7C287588EA63F8FD01027C838B50ACA22FC10B60B42CBFC66DD53465F741A90FF162458C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@.................................hzo...@.............................................T...........@Co..,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1028\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2025
Entropy (8bit):	6.231406644010833
Encrypted:	false
SSDEEP:	48:cxX7DTAT8tMBCus9T3FVWmHdniarRFeOrw8Nhv2VyfN3mKNWFP44SBWWW1GyfiPq:8L4T2RJhfHP8+VYuTmQUc2mE
MD5:	1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA1:	1B3ED82655AEC8A52DAEC60F8674BC7E07F8CFEB
SHA-256:	1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
SHA-512:	C6CCB188281F161DEBF02DCDDE24B77D8D14943DEED8852E77E5AFB18F3F62683AB1AE06DCEB1E09D53804A76DF6400A360712D8E7E228B7F971054BB4FB2496
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-tw" Language="1028" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName] ...... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ...... UI ............ UI ... ........... UI ........../norestart - ................UI ............./log log.txt - ............ %TEMP% ......</String>.. <Stri

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1029\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2458
Entropy (8bit):	5.36165936198009
Encrypted:	false
SSDEEP:	48:cxX7DTZT8u9cktosM6re4mSTcIIyfI7sh/DMNwIHWAoN3mepNRfKPnWZ0hqAQZfC:8LxTK23f33AwIViRrRynRuZfiMS
MD5:	CC8C6D04DC707B38E0F0C08BA16FE49B
SHA1:	95EA7F570677AEA52393D02FDB21CEBB218A7343
SHA-256:	DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
SHA-512:	A4B19EBC8BB0D88ABA7D3D5783E28F8B6E0960582A540059BC71076B1203BF43BCA15EA726272D15395C7B4E431046ADA1CBB9D55072BBC5DBE7729C4599F0E0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="cs-cz" Language="1029" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalace produktu [WixBundleName]</String>.. <String Id="Title">Pro instalaci produktu [WixBundleName] je vy.adov.no rozhran. Microsoft .NET Framework.</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/passive \| /quiet - Zobraz. minim.ln. u.ivatelsk. rozhran. bez jak.chkoli.. v.zev, nebo nezobraz. ..dn. u.ivatelsk. rozhran. ani ..dn. v.zvy. Ve v.choz.m.. nastaven. se jak u.ivatelsk. rozhran., tak i v.echny v.zvy zobrazuj....../norestart - Potla.. jak.koli p

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1030\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	5.061915970731254
Encrypted:	false
SSDEEP:	48:cxX7DCrT81tbzjamsjFq7LhzqGgdRDJNbqoN3mpN+ELPnfyOwYxPyzraXnAF:8LaTOkaEOiGd/BwF
MD5:	7C6E4CE87870B3B5E71D3EF4555500F8
SHA1:	E831E8978A48BEAFA04AAD52A564B7EADED4311D
SHA-256:	CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
SHA-512:	2A02415A3E5F073F4530FD87C97B685D95B8C0E1B15EFD185CC5CB046FCF1D0DCE28DB9889AD52588B96FE01841A7A61F6B7D6D2F669EAB10A8926C46B8E93D1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="da-dk" Language="1030" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation af [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework skal v.re installeret i forbindelse med Installationen af [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Er du sikker p., at du vil annullere?</String>.. <String Id="HelpHeader">Hj.lp til installation</String>.. <String Id="HelpText">/passive \| /quiet - viser en minimal brugergr.nseflade uden prompter eller.. viser ingen brugergr.nseflade og ingen prompter... Brugergr.nsefladen og alle prompter vises som standard...../norestart - skjuler fors.g p. genstart. Der vises som standard en.. foresp.rgse

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1031\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	5.094465051245675
Encrypted:	false
SSDEEP:	48:cxX7DASTcCwit/soJy9hkVByUZN+29N3mfN65PS9CvZwZi7uuASD:8LxT8itGeVB97+gyC9BdaSD
MD5:	C8E7E0B4E63B3076047B7F49C76D56E1
SHA1:	4E44E656A0D552B2FFD65911CB45245364E5DBF3
SHA-256:	631D46CB048FB6CF0B9A1362F8E5A1854C46E9525A0260C7841A04B2316C8295
SHA-512:	FD7E8896F9414F0DB7A88F926F55EE24E0591DA676F330200BC6BB829EB32648D90D3094E0011BFE36C7BA8BE41DFD74B12D444AFEA0D2866801258DA4FA16E8
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="de-de" Language="1031" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <UI Control="InstallButton" Width="180" />.. .. <String Id="Caption">[WixBundleName]-Setup</String>.. <String Id="Title">F.r das [WixBundleName]-Setup ist Microsoft .NET Framework erforderlich.</String>.. <String Id="ConfirmCancelMessage">Sind Sie sicher, dass Sie den Vorgang abbrechen m.chten?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne.. Eingabeaufforderungen oder keine Benutzeroberfl.che und keine.. Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und.. alle Eingabeaufforderungen angezeigt...../no

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1032\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3400
Entropy (8bit):	5.279888750092028
Encrypted:	false
SSDEEP:	48:cxX7D8jVT8dUk9Ug/usOo2pNSBIbESvR2drdESPzghC76DeN2hL0eLoN3mOLSNIx:8L45TCyop5riGzH7xgJit8IqSsBwqk
MD5:	074D5921AF07E6126049CB45814246ED
SHA1:	91D4BDDA8D2B703879CFE2C28550E0A46074FA57
SHA-256:	B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
SHA-512:	28DAC36516BCC76BCC598C6E7ABDE359695F85AB7A830D6ADBC844EB240D9FA372CB5A5CE4DBE21E250408C6B246D371D3CDD656D2178FB0EC22DAC7D39CBD9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="el-gr" Language="1032" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">........... ... [WixBundleName]</String>.. <String Id="Title">... ... ........... ... [WixBundleName] .......... .. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">..... ....... ... ...... .. ..... .......;</String>.. <String Id="HelpHeader">....... ... ... ...........</String>.. <String Id="HelpText">/passive \| /quiet - ......... ........ ........... ... ............. .......... ...... ..... ........ . ... ..

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1035\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2235
Entropy (8bit):	5.142592159444541
Encrypted:	false
SSDEEP:	48:cxX7DE+T8Z+bm5snwETMAoQEATN27uNBDReq4N3mJeNHNP64NsFKJJem4vyAs:8LZTDkZ7+2IBCht6J8neHs
MD5:	E338408F1101499EB22507A3451F7B06
SHA1:	83B42F9D7307265A108FC339D0460D36B66A8B94
SHA-256:	B7D9528F29761C82C3D926EFE5E0D5036A0E0D83EB4CCA7282846C86A9D6F9F3
SHA-512:	F7BE923DC2856E0941D0669E2DE5A5C307C98DC7EBA0A1B68728EB29C95B4625145C2AD3AC6F6B6D82F062887EA349E2187F1F91785DDE5A5083BC1150E56326
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fi-fi" Language="1035" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] -asennus</String>.. <String Id="Title">Microsoft .NET Framework tarvitaan [WixBundleName] -asennusta varten</String>.. <String Id="ConfirmCancelMessage">Haluatko varmasti peruuttaa?</String>.. <String Id="HelpHeader">Asennusohjelman ohje</String>.. <String Id="HelpText">/passive \| /quiet - n.ytt.. mahdollisimman v.h.n k.ytt.liittym.st.; ei.. kehotteita tai ei k.ytt.liittym.. ja kehotteita. Oletusarvoisesti.. k.ytt.liittym. ja kaikki kehotteet n.ytet..n...../norestart - est.. uudelleenk.ynnistysyritykset. Oletusarvoisesti.. k.ytt.liittym. kysyy ennen uudelleenk.yn

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1036\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	5.076293283609686
Encrypted:	false
SSDEEP:	48:cxX7DyBT81BbKBswAL1xV1wjRcDSNwDXoN3mSZfNhkLPkQpznsdMEodAY:8LwTK5KHsijmEXY
MD5:	AA32A059AADD42431F7837CB1BE7257F
SHA1:	4CD21661E341080FB8C2DEFD9F32F134561FC3BA
SHA-256:	88E7DDACD6B714D94D5322876BD50051479B7A0C686DC2E9EB06B3B7A0BC06C9
SHA-512:	78E201F369E65535E25722DFC0EFE99EDF641F7C14EFF1526DC1CC047FF11640079F1E3D25C9072CF25F4804195891BE006FC5ED313063AFCB91FB5700120B88
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fr-fr" Language="1036" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework requis pour l'installation de [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.tes-vous s.r de vouloir annuler.?</String>.. <String Id="HelpHeader">Aide de l'installation</String>.. <String Id="HelpText">/passive \| /quiet - affiche une interface minimale sans invites ou n'affiche.. aucune interface ni aucune invite. Par d.faut, l'interface et toutes les.. invites sont affich.es...../norestart - annule toute tentative de red.marrage. Par d.faut, l'interface.. affiche une invite avant de red.marrer..

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1038\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	5.293225307744296
Encrypted:	false
SSDEEP:	48:cxX7DwzT8cSwvs48mF7GD/g1v0wH7N3wwJxL99oN3m/ZNRUYPBZRT1XESW3o/ULG:8LQT2wpFGbgT3wMN2QRj/y/LKr
MD5:	17FB605A2F02DA203DF06F714D1CC6DE
SHA1:	3A71D13D4CCA06116B111625C90DD1C451EA9228
SHA-256:	55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
SHA-512:	D05008D37143A1CC031F4B6268490A5A10FBB686C86984D20DB94843BDC4624EF9651D158DCB5B660FC239C3C3E8D087EB5D23FFFB8C4681910CBC376148F0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="hu-hu" Language="1038" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] telep.t.</String>.. <String Id="Title">A(z) [WixBundleName] telep.t.s.hez Microsoft .NET-keretrendszer sz.ks.ges</String>.. <String Id="ConfirmCancelMessage">Biztosan megszak.tja?</String>.. <String Id="HelpHeader">A telep.t. s.g.ja</String>.. <String Id="HelpText">/passive \| /quiet - Minim.lis felhaszn.l.i fel.let megjelen.t.se k.rd.sek.. n.lk.l, illetve felhaszn.l.i fel.let .s k.rd.sek megjelen.t.se n.lk.li.. telep.t.s. Alapesetben a felhaszn.l.i fel.let .s minden k.rd.s megjelenik...../norestart - Az .jraind.t.si k.r.sek elrejt.se. Alapeset

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1040\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.985260685429469
Encrypted:	false
SSDEEP:	48:cxX7DQyT81ebRcesyB+lY25ukVpkXJM2DJNXhpXZoN3mMhNTM+POYO/n1YxXlcI5:8LFTzLtkfwWKXHZi37MIDp
MD5:	50261379B89457B1980FF19CFABE6A08
SHA1:	F80B1F416539D33206CE3C24BA3B14B799A84813
SHA-256:	A40C94EB33F8841C79E9F6958433AFFD517F97B4570F731666AF572E63178BB7
SHA-512:	BBD9794181EEC95D6BE7A1B7BA83FD61AF2B2DF61D9DA8DDA2788B61BEC53C30FCEFE5222EDF134166532B36D3AB6CE8996F2D670DC6907C1864AF881A21EA40
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="it-it" Language="1040" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework necessario per l'installazione di [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida dell'installazione</String>.. <String Id="HelpText">/passive \| /quiet - visualizza l'interfaccia utente minima senza istruzioni.. oppure non visualizza n. l'interfaccia utente n. le istruzioni. Per.. impostazione predefinita vengono visualizzate interfaccia utente e.. istruzioni...../norestart - elimina eventuali tentativi di riavvio. Per impostazione.. predefinita l'int

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1041\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2545
Entropy (8bit):	5.923292576429967
Encrypted:	false
SSDEEP:	48:cxX7DpcYT86WyscLpTIFw6tnOUjsj/D3NIgHcQN3mKN/WPOhT0SXsDay+z8QZEcE:8L1TccOFw6tnOUjsjpICnlOO934apWz
MD5:	DB0F5BAB42403FD67C0A18E35E6880EC
SHA1:	C0A18C8C5BCD7B88C384B5304B56EEB85A0DA3DC
SHA-256:	CCDCDB111EFA152C5F9FF4930033698B843390A549699AE802098D87431F16FE
SHA-512:	589522BD4A26BF54CCF3564E392E41BBBA4E7B3FD1ED74E7F4F6AD6F2E65CDE11FFF32D0C5F3BCD09052FE5110FDC361D1926E220FD0BAD2D38CAC21BBE93211
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ja-jp" Language="1041" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ......</String>.. <String Id="Title">[WixBundleName] ........ Microsoft .NET Framework .....</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/passive \| /quiet - ... UI ....................UI.. .............. .....UI ....................../norestart - ........................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1042\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2236
Entropy (8bit):	5.97627825234954
Encrypted:	false
SSDEEP:	48:cxX7D3sT8ZeusKOwOWGyKCstFmhENI2Y+kN3mp4iNmi6IPa0dDaoIunvZqIHU5UH:8LQTXvRFhIzl44wmgko04U5TY
MD5:	442F8463EF5CA42B99B2EFACA696BD01
SHA1:	67496DB91CBAA85AC0727B12FC2D35E990537DAC
SHA-256:	D22F6ADA97DBFFC1E7548E52163807F982B30B11A2A5109E71F42985102CCCBD
SHA-512:	A350EAF9E7AEAFAB1163D7C0B8D014AFE07EE98BAE3915CBDD3C26282E345A0838E853C89BAE8943474758DCBCFD0BB0724A0C75CBF969F321FAB4944E8704FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ko-kr" Language="1042" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] ... ... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/passive \| /quiet - ... .. .. UI. ..... UI. .... .... .... ..... ..... UI . .. .... ........../norestart - .. ..... ... ...... ..... UI. .. .... .. .... ......../log log.txt - .

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1043\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.965432037520827
Encrypted:	false
SSDEEP:	48:cxX7DK1T8u7hbU7Asd7MqpSwzCcHGFN9OsNN3mvoNBC7hPFtO7+xw7t0Yza2Al:8LcTtpGLFSwJHmPnnKhEBtsl
MD5:	67F28BCDB3BA6774CD66AA198B06FF38
SHA1:	85D843B7248A5E1173FF9BD59CB73BB505F69B66
SHA-256:	226B778604236931B4AE45F6F272586C884A11517444A34BF45CD5CAE49BE62E
SHA-512:	7BC7D3E6E19ECF865B2CABFC46C75D516561D5A8A81A8ED55B4EDBA41A13A7110F474473740200AFB035B9597A2511D08C2A2E7A9ADE2C2AB4D3F168944B8328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nl-nl" Language="1043" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installatie</String>.. <String Id="Title">Microsoft .NET Framework is vereist voor installatie [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Weet u zeker dat u de installatie wilt annuleren?</String>.. <String Id="HelpHeader">Help bij Setup</String>.. <String Id="HelpText">/passive \| /quiet - geeft een minimale gebruikersinterface weer zonder prompts.. of geeft geen gebruikersinterface en geen prompts weer. Gebruikersinterface.. en alle prompts worden standaard weergegeven...../norestart - pogingen tot opnieuw opstarten onderdrukken... Gebruikersinterface vraagt standaard al

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1044\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.089922193759582
Encrypted:	false
SSDEEP:	48:cxX7DTeT8uUbnFdsLnFHv+Gpm1qL5DQNDDaoN3mpZfN15dPnfuOOg5wZ5uAq8fAS:8L+Tec1x8Siule4S
MD5:	5454F724C9CDAB8172678A1CC7057220
SHA1:	241A57018ACE1210881583A9CF646E7D2E51412F
SHA-256:	41545AC1247B61C3C3E2A7E4659D9FAD2BCCA8347C69F2EB7B9D0CF5FC31E113
SHA-512:	40E311EADA299996E32A7D35223CA678A03C869D63C023D59BC97A7B2049B0252AA9D0A7EC8558D5ACB73BD14C7BFA913097E65ABEE7455658DB7E35BBDA8AE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nb-no" Language="1044" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installasjonsprogram</String>.. <String Id="Title">Microsoft .NET Framework kreves for [WixBundleName]-installasjon</String>.. <String Id="ConfirmCancelMessage">Er du sikker p. at du vil avbryte?</String>.. <String Id="HelpHeader">Installasjonshjelp</String>.. <String Id="HelpText">/passive \| /quiet - viser minimalt brukergrensesnitt uten ledetekster, eller.. ikke noe brukergrensesnitt og ingen ledetekster. Som standard vises.. brukergrensesnitt og alle ledetekster...../norestart - undertrykker alle fors.k p. omstart. Som standard sp.r.. brukergrensesnittet f.r omstart.../log log.txt

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1045\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	5.270514043715206
Encrypted:	false
SSDEEP:	48:cxX7Du4OT82gXusarwkfpYrKD8DTNkbNuoN3mjbsNniIPh8ynN1NYd4iYuffAL:8LKTsXgpYr2IyoiiOffpT3L
MD5:	96ACAAA5AEF7798E9048BAFF4C3FA8D3
SHA1:	E76629973F6C1CFC06F60BA64FE9F237B2DB9698
SHA-256:	F4AA983E39FB29C95E3306082F034B3A43E1D26489C997B8E6697B6A3B2F9F3C
SHA-512:	964F73E572BDCB1AD946C770E6A2FB4A1CE54AF4B5BB072F64256083BA27A223F4DAD4A95B9D2A646180806D1F977726147970B06AAC35EED75AEC6CA89ED337
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pl-pl" Language="1045" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator programu [WixBundleName]</String>.. <String Id="Title">Do zainstalowania programu [WixBundleName] jest wymagany program Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Pomoc instalatora</String>.. <String Id="HelpText">/passive \| /quiet - wy.wietla minimalny interfejs u.ytkownika bez monit.w.. lub nie wy.wietla interfejsu u.ytkownika ani monit.w. Domy.lnie jest.. wy.wietlany interfejs u.ytkownika i wszystkie monity...../norestart - pomija wszelkie pr.by ponownego uruchomienia. Domy.lnie.. interf

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1046\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.130635342194656
Encrypted:	false
SSDEEP:	48:cxX7DuoT85b0s/4TDoYDj4NF5j2hN3mMNYskPDXKIMaKcP9A5g:8L1TmBHjs59M8r6
MD5:	BD39ADB6B872163FD2D570028E9F3213
SHA1:	688B8A109688D3EA483548F29DE2E57A8A56C868
SHA-256:	ECB5C22E6C2423CAF07AEBE69F4FAF22450164EEE9587B64EF45A2D7F658CA15
SHA-512:	F2826BE203E767D09FF0D7677E1CF5B13113B773D529166DAE02A1F5DB2DC58E0856A34901DF70011EBABB6E964FAB7ACF38590E650BD629D4E4DC4CB36C8D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-br" Language="1046" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">Microsoft .NET Framework . necess.rio para instala..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/passive \| /quiet - exibe UI m.nima sem avisos ou exibe sem UI e.. sem avisos. Por padr.o a UI e todos avisos s.o exibidos...../norestart - suprime qualquer tentativa de reinicializa..o. Por padr.o a UI.. ir. solicitar antes de reiniciar.../log log.txt - logs para um arquivo espec.fico. Por padr.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1049\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.408094213063887
Encrypted:	false
SSDEEP:	48:cxX7DkTT8fjtEeusogrohY2Ar7DHNnjTh53oN3miRMNKrdPin+/uYcbSkuEIcOvG:8LYT8EeHMMJRNi1Ruwi3OwL
MD5:	DAF167AF4031EF47E562056A7D51AA73
SHA1:	0156B230CADD6169AC2820865E3C031ED79785EF
SHA-256:	C91C9E87AB4A6DB078F1991F4A2CDC726B58A40E47BCE49D39168A8F8F151C3B
SHA-512:	5E87EE3838E3595ADBD7EABA6E3E33CDFEA5E15ED716FBCCDBD55235B3E53E1E41EA5A907F425E96C35167543C7F75AC5214B5AEE177D299FC2464A68B22851E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ru-ru" Language="1049" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">......... [WixBundleName]</String>.. <String Id="Title">... ......... [WixBundleName] ......... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........ ........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/passive \| /quiet - ........... ............ .. ... ........ ... ...... ... .. .. . ............ .. ......... ............ .. . ... ......

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1051\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.397882326481071
Encrypted:	false
SSDEEP:	48:cxX7D+cT8muPusz2qs1u+Vh1TqDINHZJoN3m8fN0vPp3OAwa2ywSODAm:8L1TuPdKNzfifFmcatm
MD5:	016C278E515F87F589AD22C856B201F7
SHA1:	F20C7DB38B3161B143DEC4E578CE71D7F585F436
SHA-256:	4A7FDF4A9033FE05C31F565ED3AE5B8C67D324B7AEADB737CE95DBB416D46868
SHA-512:	310C85B27E1ECF4C6729E88051037150CFBA0234A0138666C26662B3D665FF38B74E95ABCADDEEF6CBEBB23E3357FAC487E6EE5EB8FE158C269D77672191B042
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sk-sk" Language="1051" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] . in.tal.cia</String>.. <String Id="Title">Na in.tal.ciu aplik.cie [WixBundleName] sa vy.aduje s..as. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Naozaj chcete zru.i. oper.ciu?</String>.. <String Id="HelpHeader">Pomocn.k pre in.tal.ciu</String>.. <String Id="HelpText">/passive \| /quiet . zobraz. minim.lne pou..vate.sk. rozhranie bez v.ziev alebo.. nezobraz. .iadne pou..vate.sk. rozhranie ani v.zvy. Predvolene sa.. zobrazuje pou..vate.sk. rozhranie aj v.etky v.zvy...../norestart . zru.. v.etky pokusy o re.tart. Pou..vate

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1053\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	5.1255014007111495
Encrypted:	false
SSDEEP:	48:cxX7DviT8NFLbu9sM2vECjf26axBZYXcqADCNKTbkoN3maT6NWOjEXPauOOKYnhf:8LmTAcRnQXFPK0iHMsfb2Ws3M
MD5:	D95E81164C57B6FD75E7C3022454192E
SHA1:	5D5ACBC56E7078AF4D04C45B78C0FF090C02EE6A
SHA-256:	6DD61CC6B87B53EAF28430068A2A459730FD4B2BCF876CCDF040212D04C4FE7D
SHA-512:	9E4BA81A145574818DD6A1F1D0EC38EA1629C7771919C35923F440E31EA9912E1630D94FCDB82B71104EBD61D0321DCDF935BA20D69988EE6E9B22259186AF0C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sv-se" Language="1053" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-installation</String>.. <String Id="Title">Microsoft .NET Framework kr.vs f.r installation av [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Vill du avbryta?</String>.. <String Id="HelpHeader">Installationshj.lp</String>.. <String Id="HelpText">/passive \| /quiet - visar ett minimalt anv.ndargr.nssnitt utan prompter,.. alternativt inget anv.ndargr.nssnitt och inga prompter. Som standard visas.. anv.ndargr.nssnitt och samtliga prompter...../norestart - hejdar omstart. Som standard visar anv.ndargr.nssnittet en.. prompt f.re omstart.../log log.txt - skapar logg till

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1055\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.2754753523795275
Encrypted:	false
SSDEEP:	48:cxX7DNcYT8anOSMsHEqGpcBztpvrJlrs2ZmNI2+Yo6irN3m22NFcPc+4Trzrdgc7:8LZHTE7APaTI9sq6yEbgg
MD5:	01B200E06BA600A4EF00C00F7AAC5CE4
SHA1:	22234426C42637E069A46217019551E4434A4AB6
SHA-256:	06BFB6DFBC38105C699DEA226A029DF3EF673C33E4B8928DC4EC7FB8F761487D
SHA-512:	8BDCF7533A6BCFA231B42A7EF845A70C7535FBF607D62FF6404928D5941BA6AFBF139450A1A1B58C65FACF88DC0785AEC4ABEFBCC803466A58B1930F7C468CDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="tr-tr" Language="1055" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName] kurulumu i.in Microsoft .NET Framework gerekir</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/passive \| /quiet - komut istemi olmayan olabildi.ince k...k bir UI.. g.r.nt.ler veya komut istemi ve UI g.r.nt.lemez. Varsay.lan olarak UI.. ve t.m komut istemleri g.r.nt.lenir...../norestart - yeniden ba.latma denemelerini engeller. Varsay.lan.. olarak UI yeniden ba.latmadan .nce komut isteyecekt

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1060\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.1485120966265
Encrypted:	false
SSDEEP:	48:cxX7DZ0T8obZsw9g5gS56K97D7NCt2VoN3mQXNJPOhP58vqc1qwueo3RAL:8LyTLlS9h9hCtsihdxOh+NL
MD5:	5836F0C655BDD97093F68AAF69AB2BAB
SHA1:	B6842E816F9E0DCC559A5692E4D26101D10B4B16
SHA-256:	C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
SHA-512:	640A79D6A756E591AD02DDCCC53BC43F855C5148B8CBB5CE6C1CAF5419CA02F7B2AFF89CCA4C056356814D3899EF79BF038B4E8B4B79EB85138A3CEDCCE93E5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sl-si" Language="1060" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Namestitev</String>.. <String Id="Title">Microsoft .NET Framework, potreben za namestitev paketa [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Ali ste prepri.ani, da .elite preklicati?</String>.. <String Id="HelpHeader">Pomo. za namestitev</String>.. <String Id="HelpText">/passive \| /quiet - prika.e minimalni uporabni.ki vmesnik brez pozivov ali ne prika.e.. uporabni.kega vmesnika in pozivov. Privzeto so prikazani uporabni.ki vmesnik in.. vsi pozivi...../norestart - skrije vse mo.nosti za vnovicni zagon. Privzeto uporabni.ki vmesnik.. prika.e poziv pred ponovnim zag

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\2052\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	6.189594519053644
Encrypted:	false
SSDEEP:	48:cxX7DjQT8tOBousi+zq+frUR2ropNV2rfN3msNUqPPT9T+DwZ9f5wDTAV:8L4TGUGw3V8N3RykV
MD5:	A34DCF7771198C779648B89156483E83
SHA1:	A6E0FA91CD50048511C7BEF1BE3A8D32B42B6D1F
SHA-256:	89C559C6765F8D643469E3C8F4AA93023F09369B0395EA647FAD5AF3C2893EB6
SHA-512:	0F1D7BC4FD64E18EEEC488CDCE01FB6BFA5CD3BFF614A8D03E388D39F569B8341E74302946877EB25BA1EB17AEC137499189605E251FAFB6B20051744CB463B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-ch" Language="2052" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] .... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ..... UI .......... UI ... ........... UI ........../norestart - .............. UI ........../log log.txt - .............. %TEMP% ........</String>.. <String Id="HelpCloseButton"

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\2070\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2211
Entropy (8bit):	5.1155097909395035
Encrypted:	false
SSDEEP:	48:cxX7DbT8QGls54nK3znI5zKDj4NLkdoN3mMNYsEPbpK2Aegeu9A5g:8LXTUasJnYdi59som6
MD5:	8A278E519EF81B2847490EFB070219BC
SHA1:	7365EDF6E4F9E66B6CEE47933B6C70FF0B9ECFF8
SHA-256:	E2BFDB2CF3BEAE2E988827C52C58006D7EEAD4ABA5312B5EAE1F6CCF3863C385
SHA-512:	88275C1136FFB15AB04D315E8601BE2DE77387F3E00F17E9807E415A9DFC4A73E2CD3B5710E4CA58006F91E18180D7CFAEEF4E8319C624E1B81397F9CB9ECA92
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-pt" Language="2070" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Configura..o do [WixBundleName]</String>.. <String Id="Title">O Microsoft .NET Framework . necess.rio para a configura..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem a certeza de que pretende cancelar?</String>.. <String Id="HelpHeader">Ajuda da Configura..o</String>.. <String Id="HelpText">/passive \| /quiet - apresenta IU m.nima sem mensagens ou n.o apresenta IU nem.. mensagens. Por predefini..o, s.o apresentadas a IU e todas as mensagens...../norestart - suprimir qualquer tentativa de rein.cio. Por predefini..o, a IU.. avisar. antes de reiniciar.../log log.txt - r

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\3082\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2400
Entropy (8bit):	4.992567587099768
Encrypted:	false
SSDEEP:	48:cxX7DLT8/OusS2V8j4Lq+7dKzCLdqaaD6NJaXFoN3mRNLo3PWKWnRcsB9A8:8LfTz+8EPqKqTJiFikUgk8
MD5:	1024AA88AE01BC7BA797193CC6023375
SHA1:	9252A309C1CB32573F4D58A595A78660FDF54B2F
SHA-256:	B884C4ABB8867553C1FFADD6721C2135EC5F9F1455C3F668D711CCEA65363D1A
SHA-512:	77E6DD332104C0461B7C5A08469161AF3F1DC51D3B55585D39DD9FC9E2088DA036BDF2278CFB96CA702FD26CE073C6C6F66611313270700B9E7A76600C1C8E38
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="es-es" Language="3082" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">La instalaci.n de [WixBundleName] requiere Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="HelpHeader">Ayuda del programa de instalaci.n</String>.. <String Id="HelpText">/passive \| /quiet - muestra una interfaz de usuario m.nima y no realiza.. preguntas, o bien no muestra interfaz de usuario y no realiza preguntas... De manera predeterminada se muestra la interfaz de usuario completa y se.. realizan todas las preguntas necesarias...../norestart - suprime cu

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	487640
Entropy (8bit):	6.164305569969911
Encrypted:	false
SSDEEP:	6144:MjyIhEMMRMRMwr/irwWWx8saRk0taAoaD4p2H2DDhWF2ugJQztU4EDMolZ9C:TILMjwTWWmsGxVoaD4p2H2DAgJuSJZ9C
MD5:	D8CDFE259C09B2DE638EF4A5BF2D4DCE
SHA1:	C06074A1965C2C773E92F85418DCEB2C5FDFEAF0
SHA-256:	5BC6335BC9649AF916A82965E3B55C1B693C216B4FA4D76740F2DB4616E82CD5
SHA-512:	752E99ADF65BC926F2C1AE47ECADF271F788D46CEAB47C525FD8EC97A9388FE8F38564C63896A8D61AABA5652F37703CD234F463BEF58781466AAA2B0AC0B079
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.CrashReporter.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: __.exe, Detection: malicious, Browse Filename: __.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0..............!..0..<...........Z... ...`....@.. ....................................`.................................PZ..K....`...............D...,...........Y............................................... ............... ..H............text....:... ...<.................. ..`.rsrc........`.......>..............@....reloc...............B..............@..B.................Z......H.......................\|....O..uY......................................"+.(.{8I...B(....(....(.......:+.(`.e/.(.....:+.(.64Q.(............................8.....(.... ....~~...{E...9....& ....8....8........E........8.............................8.....(.... ....8....8........E....<.......=.......87.....(.... ....8......(.... ....~~...{....9....& ....8......(.... ....~~...{]...:....& ....8......"........................................8........E............8......}.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	907480
Entropy (8bit):	6.2012128600362955
Encrypted:	false
SSDEEP:	12288:DgA3kpCVBwmOzfbi4WZGkc2IClrwDD7bmXX9fyY+:F0fnz3clI7bhv
MD5:	7DF624F2AB3DBE6C5FBCA91F6EA59430
SHA1:	702A5C61AFB3D56C89513E08244359A1B7F4F6E7
SHA-256:	B43544BF5E511B4049289CE847F7710DE6B5EEFB2CF7956CE452FFE53CA0BA7F
SHA-512:	EE38023BDB887D8BE5B18167280126809C3C9230D630C4CDAE8E650AECF8FDE2B6A1DF234FCD5D6CE2EEDE09B504137669C8E0EA06C6AA454A10D6073A3A6558
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Base.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....S'f...........!..0.................. ........@.. ....................... .......?....`.................................`...K........................,........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc..............................@..B........................H.......................`..............................................."+.(9Z.5...B(....(....(.......:+.(..]4.(......(....(............(............................8.....(.... ........8....8........E........Q...+...8......}.... ....~....{....:....& ....8......}.... ....~....{....:....& ....8...............{.............{................................8........E....................%......._...8.........~...(....:.... ....8.... ..d. ....b .#.Ya~....{....a(....

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.Installer.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	57048
Entropy (8bit):	6.04206743239607
Encrypted:	false
SSDEEP:	768:l1QqB6K9QpT6vtp+8HfMIZtiHz5wY55bvPQX/fsgM8waDAMxkEo:LQ+6KxEFdwO5DPQXXsgM8w8xU
MD5:	ABD2F4A5CFA8A9608FB14E3FBF44871F
SHA1:	B5249F54A6A73C27BCBBDC07FB6C86D9745BE35F
SHA-256:	06C54E61D243584BE70B1B1CFAA412C99E7C5107DF45BE187A157422EDF9EAA5
SHA-512:	7DCABB779787317C68A6EEB85841CA063FD9D9E3F0A90FF3AFC1FD6FDDC522913528D8E09E46E9430A4B7C1C1CC67347A5CE89F6ADEB1AD262C6CED0C041C1B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A............." ..0.............r.... ........... ....................... ...........`................................. ...O........................,..........8...8............................................ ............... ..H............text...x.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................T.......H.......0D................................................................{...."..}....2. `...(....:.(......(........0............(......,...(....o.........0..w........(....,....i.r...po....,8.r...p.o.........Yo....(.....r...p......%...M....(....+..(..........r;..p......%...(..................\\......:.( .....(......{...."..}.....r...p......%...%...(.....(....o!...o".....o#...*....0..P.......r...p......%...(.....(....o!...o"....o$.....!.r...p......%...%...(....~%....

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	636632
Entropy (8bit):	6.066203134927089
Encrypted:	false
SSDEEP:	6144:vzWO85zREXbv5vDcTMYw39udKMnK6ZtW6X/FffN4CoOwmmNy3tfda9becmlIlF0l:CTzhKNSfOOwKjcVp1p3Q
MD5:	EC3D9350A9A400FB3271C7327F5BF5A8
SHA1:	0EEA26F71E7D03579303B9FFC34549FA7AC843E9
SHA-256:	AA43B82246DE237CC9898D6EC2B18BCAFE3A1BAFBADA9FB7939359866D2909E4
SHA-512:	A789B3056303EE8680ACA458C01C947DBA6C33C14966A65EE27B338CAB2C25FB6481435063814BE81760BED25D385F4313149F5F4792620660CF6252A2E0C01E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.UI.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~.e...........!..0.................. ........@.. ..............................';....`.....................................K........................,........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@....reloc..............................@..B........................H.......................L.............................................."+.(z.ib...B(Z...(P...(.......:+.(..49.(.............{................................8........E........K.......8..... 9!). ....a~....{....a(....~....(.... ....~....{....:....& ....8......}.... ....~....{Y...9....& ....8~...............................8........E............8....* .x.l .X.ua~....{....a(..........%..o.....~....(.... ....~....{....9....& ....8.........*...............^...8.....(....

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1857240
Entropy (8bit):	6.111193707728407
Encrypted:	false
SSDEEP:	24576:IYMr/wYqFeVAiLdogUdNO8nH2OE+vAH2QBqnftgUs4SV0dXJX:GueVrLdogUdNOCHr5HlgZV0jX
MD5:	5078EDDD8DC8D0D328D7EECEB459929B
SHA1:	60F4A74DBC5F4AF10526198A5A43E09F84B54C98
SHA-256:	C63CE2079D0EE96BA13CBBA30B6CF4C7EF42720815E82D8EAC2526ADBF881F40
SHA-512:	B09B7FBDCC899BFE27F76080D95B3882875A5F53FAEC52C97418554E38373327088B750581C85FB6D66D19D3C1CCCFF6F313FCF73519B48D6B32F260A7F3A84C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Utils.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....U............!..0.. ..........>>... ...@....@.. ...................................`..................................=..K....@..t...............,...`.......=............................................... ............... ..H............text...D.... ... .................. ..`.rsrc...t....@......."..............@....reloc.......`.......(..............@..B................ >......H.......,...Tu...........A.......=......................................"+.(.{i...B(....(....(.......:+.(}.&l.(.....:+.(0.wL.(.............{.............{.........................}......}.................................8........E........!...........Y...3...8z...(.....{......{....o.........;.... ....8....(.....{......{....o....9.... ....8......:.... ....~....{....:o...& ....8d...8.... ....~....{....9K...& ....8@....u...... ....~....{....9$...& ....8...........

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	392408
Entropy (8bit):	6.030957500184647
Encrypted:	false
SSDEEP:	6144:ykiME4ik32wVgWe2ZSi2zQG8PR/BOxbDU8RJ0lu:yq+noHe2czf652bI8fIu
MD5:	0FC409AE184FEFB12DC266ED5F0A3862
SHA1:	9EAA83402A9C2E7DECE73114FA780BC8C65572A1
SHA-256:	43913461ECEB87C5D7B45E3449851EE4F66AF8CDAFCC9DB3C2874C2CB861AB65
SHA-512:	6DD3E463AAF27CD62F1FA066344CEAC23D6AF2B84CB0FFC3C23F44B752D126641C00354F20A66C76E81109AE39DA817B82E408D203102D1B33B83FB4BB9014CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.Common.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ro&f...........!..0.................. ........@.. .......................@......ce....`.................................`...K........................,... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc....... ......................@..B........................H............i.........................................................."+.(..\|h...B(....(....(.......:+.(+-!i.(.....:+.(.XpG.(...........................}......}......}.......}.....(..................................8........E........]...J...4...+...........8......:Q... ....~C...{T...9....& ....8......s....z..{....9.... ....8.....{.......8v...8p....8.... ....~C...{S...:h...& ....8]... ..c. .i.ma~C...{....a(...... ....86...8.... ....~C...{=...:....& ....8....... ....~

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1522904
Entropy (8bit):	5.938731880648518
Encrypted:	false
SSDEEP:	12288:aPbPATspyDCvDg0OGujH5CGOt3+llYpeUcUlVpAb/xHwd9+GaHnK+PUYNToczPkp:ajSCvcFGkCW72NMOiTH7lWNfnMfQqJY
MD5:	E8B18DF3EF0D16DAAB0B0C8A4D79E399
SHA1:	8AF84E066266BBF5226BC4BE7E7933FD76DA9C9F
SHA-256:	EA32A09C257867BE8527E9F64DD2B19502992E913436D18C37376F92AC74333A
SHA-512:	6316FBAEC1800304719BFB8FB3C87CD865E6024A40A783FE9396E4A10BCB5A634EBAF9225393B4F20B9D4E4CD224349659987844555046CD6413728E10D89823
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuard.Vpn.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...So&f...........!..0.............^$... ...@....@.. ....................................`..................................$..K....@...................,...`.......#............................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@....reloc.......`......................@..B................@$......H...........4................G..I#......................................"+.(u.dd...B(....(....(.......:+.(.9f.(.....:+.(.KhC.(................................8........E........)...P...8....8F... ....~....{\|...:....& ....8.....~...... ....~....{h...:....& ....8..........0..........(.... ........8........E......../.......F.......8....*(.... ....8............%. ..@. ...jY WL..a~....{`...a(.....%. 5..p .Q?Aa~....{z...a(.....%. gk@. ....b 5.=.a~....{....a(.....%. .m.O ....X

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	261632
Entropy (8bit):	5.279521785173736
Encrypted:	false
SSDEEP:	3072:x3y0+6GObAXHZLmIpKVcKl7oc3jo5bh1:xC0xpbA3N8hl7oc3jo5b
MD5:	DEE30F3E6BA778C751F2F60FB4670478
SHA1:	498124DA412A7A4D8BB6B78228F800B583262100
SHA-256:	44C456F809E765A91C4527B55591301EAF74260D92FDD786F3E4053B700B2864
SHA-512:	F8F3928AACE5E6FB593966AC6D2ED113598C37A0B767CBE4EDA7D9F53E3E612BCF4642FFE3BF1432FD564716C1F4A02F72D8E6D0279D6262593B1F9FDCA19A04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../.9..........." ..0.............2.... ... ....... .......................`............`.....................................O.... .......................@..........8............................................ ............... ..H............text...H.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H.......pX..............d...............................................>. 4......(....2......o....:........o.....0..,........o....r...p $...........%...%....o....t....&...o......(.....~............~.....r!..pV(....o....rC..po.....rK..p.(3....(4....r...p.r...p.r#..p.(8....(........0..b.......rq..p......( ...(!....("...-..-..(H...r...p(.......(#...&r...p......%...^....( ....,..(.....($......0..........r1..p......( ...r...prg..p~%...(...+..('...,.r}..p......

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.Burn.dll.config

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	656
Entropy (8bit):	4.964696021977938
Encrypted:	false
SSDEEP:	12:MMHdn9nF3F7yA5v5OXrSl2/uo+/toA5ceeycl2/kr/tOixj:JdnxNF7yYhOXrSl2/uo+/toYJUl2/krj
MD5:	F3B06257FAE705165146B020D3053745
SHA1:	2EC73BF60269CDCCE621B44297B7EDCD126EB4D4
SHA-256:	B005A38601A8027DC44688FF52C52E98DB2FD49721CBF3A1876828CF8350E2CB
SHA-512:	9660BAD0671B0EA7B02524A68C9382FA3CC7DBF54BCC63822DFCEC7BA47B2393E5207126023FA7979ACB084358819C93BBCD4087CA00ABAFA44353E785DE5A74
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<configuration>. <runtime>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0" />. </dependentAssembly>. <dependentAssembly>. <assemblyIdentity name="AdGuard.Utils" publicKeyToken="cc321ba03e90d705" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-2.4.0.0" newVersion="2.4.0.0" />. </dependentAssembly>. </assemblyBinding>. </runtime>.</configuration>.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\AdGuardVpn.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6411992
Entropy (8bit):	6.750783795781533
Encrypted:	false
SSDEEP:	98304:+esgE8FWJVPzlAJIDyM9EM8ZeykW4yr7sCklgxNLllI+pe4:qglwzlAJIDyM9EM84xW4y/sC1LUR4
MD5:	D1A5895B27AB2B99D91FAA998D23B58E
SHA1:	407CAED4FBD0D9EA1646FF0AFEDC11334F39B3AD
SHA-256:	364531A0A4C65B2132398B1A9085CF3ADE18CF9315795F4792FFDC2DDBB4E4A8
SHA-512:	2557F86BF58BFBECAF583819740095E0B2A3BD7DAD1E11F11D21C542C5547C7EBA08D55ECC4580E11E65125B88212F504C3E8AA9BD44A32FA6160A12573F3190
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$..........u.l.&.l.&.l.&B..'.l.&B..'Ml.&5..&.l.&5..'.l.&5..'.l.&5..'.l.&.l.&.l.&B..'.l.&...'.m.&B..'.l.&.l.&.m.&...'.l.&...'.l.&...'.l.&...'.l.&...&.l.&.lz&.l.&...'.l.&Rich.l.&........................PE..L...>o&f...........!...$.RG..RC.....i.C......pG......................................Qb...@..........................].......].........0.............a..,.......A....\.T.....................\.....P.\.@............pG..............................text....QG......RG................. ..`.rdata...t...pG..v...VG.............@..@.data....~*...].......].............@....detourc.....p.......N_.............@..@.detourd.............`_.............@....rsrc...0............b_.............@..@.reloc...A.......B...h_.............@..B........................................................................................................................................................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (450), with CRLF line terminators
Category:	dropped
Size (bytes):	5792
Entropy (8bit):	3.789889000212775
Encrypted:	false
SSDEEP:	96:XQdn6d0dUIychfn6JWaFU0yc5n68AN0woycwvUk4ve8Xr+sqLt:XeOnYfaeuvLIL/gbi
MD5:	F915AC2A7264034E779F60DB535DA9F1
SHA1:	39689D2B2380D442EAAFC298D610CEC4995EB7DB
SHA-256:	A97F6C2FA7F994E0F50219F5D554FABA9F42FD15322BB8788B78F76423BC9ADA
SHA-512:	F971CB0F0CE628CEC8955F27A73D9C80F3627A90BEB07BC0382B02848A1C4138D7E15B1DDE021B861063D3921938163B4411C327F0FA1D5A47C30B99449F6CFE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".A.d.G.u.a.r.d.V.P.N.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.d.0.b.2.1.d.a.6.-.a.4.b.1.-.4.4.9.b.-.9.4.0.8.-.4.b.3.d.f.d.7.3.2.1.5.c.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.E.C.8.B.6.D.7.6.-.8.E.5.1.-.4.B.E.B.-.9.6.0.2.-.7.1.8.B.E.7.8.E.B.0.5.8.}.". .P.e.r.M.a.c.h.i.n.e.=.".y.e.s.". ./.>..... . .<.W.i.x.M.b.a.P.r.e.r.e.q.I.n.f.o.r.m.a.t.i.o.n. .P.a.c.k.a.g.e.I.d.=.".N.e.t.F.x.4.5.R.e.d.i.s.t.". .L.i.c.e.n.s.e.U.r.l.=.".h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.D.=.2.6.0.8.6.7.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.config

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.014979412561275
Encrypted:	false
SSDEEP:	24:2dRt7RtYr49itYQsKmhDrdHDxshqRQNF7yYhOXrSl2/uo+/tO2:cfRt0Kit0vlrh5QD7e71uo47
MD5:	427918825375CE8AA01F208629C901FA
SHA1:	BB983D3B30454DEB48695E495B8483195D72C927
SHA-256:	EEE85D8D43E427F87E043F9516BC2511C891980A134EBA7E2D6097438EF860E4
SHA-512:	1368FB726B21D96278773E37FF36B20952578C814F7E4D3EF76CC81A5B2D608F04E65C1E6328F19AA59F40DD2701D6F5AFA167CDE14143D385CD075A8359B4CF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<configuration>. <configSections>. <sectionGroup name="wix.bootstrapper" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.BootstrapperSectionGroup, BootstrapperCore">. <section name="host" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.HostSection, BootstrapperCore" />. </sectionGroup>. </configSections>. <startup useLegacyV2RuntimeActivationPolicy="true">. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />. </startup>. <wix.bootstrapper>. <host assemblyName="AdGuardVpn.Burn">. <supportedFramework version="v4\Full" />. <supportedFramework version="v4\Client" />. </host>. </wix.bootstrapper>. <runtime>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0" />. </d

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\BootstrapperCore.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90032
Entropy (8bit):	5.688550211341784
Encrypted:	false
SSDEEP:	768:9BgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ1ErEgtCmYjhm:HHMBp/GRbgi5ofpiG2pq+51EogsmYI
MD5:	B0D10A2A622A322788780E7A3CBB85F3
SHA1:	04D90B16FA7B47A545C1133D5C0CA9E490F54633
SHA-256:	F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426
SHA-512:	62B0AA09234067E67969C5F785736D92CD7907F1F680A07F6B44A1CAF43BFEB2DF96F29034016F3345C4580C6C9BC1B04BEA932D06E53621DA4FCF7B8C0A489F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Mp.].........." ..0...... ........... ...@....... ..............................N.....@.................................`...O....@...............@.......`......(-............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Google.Protobuf.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	410952
Entropy (8bit):	6.098784833091384
Encrypted:	false
SSDEEP:	6144:KwDm4/Ib3J5SSPHGFVtwb/0V0qnPEEVwoVTqcQc+QZyiu69hOKbBfM0gF2:Kw6oCrSSPHlbmMEzTqsFO+
MD5:	A93C82719E98C382D81BC0DCD99AD402
SHA1:	8814B631FD15C35E737DB42BC908791302496A83
SHA-256:	6E5DB014AE75B455A97F7F161507AE1058F489333126F30607E6E534D3DDEA82
SHA-512:	60D897EF434BDA51921E111A39B50B4E2B832C8DC3A8444A4B36A2A9D898EA200D990EA2EDFAB02689B4C1A03D1CB9110428727DAC13D70318B850D4289529F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...X.$..........." ..0............../... ...@....... ...............................d....`................................../..O....@..................H)...`..........T............................................ ............... ..H............text...,.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H.......xW......................L.........................................(E.....(E...:.(E.....}......{....:.(E.....}......{......{...."..}....V.(E.....}......}......{......{......{...."..}......{...."..}......{...."..}......{...."..}........0../...........1.......(F......X...+...%.X........X...2...0..%...........i.Y.+.................X...Y...2...s....F.(...+(H...(....:.(I.....}.....~....2.\|....(J...*.(.......2.\|....(K.....{....2.\|....(L...*..0..

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	662528
Entropy (8bit):	5.91790849905593
Encrypted:	false
SSDEEP:	6144:3o4V9ynqKoxhi0gAsfLBhJJzhGIVrdhoHuLFGAJmKApt5psaLGBFahKGRd67XLEm:LyncxQRhJJzhoqgH5sB4dxHG
MD5:	5AFDA7C7D4F7085E744C2E7599279DB3
SHA1:	3A833EB7C6BE203F16799D7B7CCD8B8C9D439261
SHA-256:	F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
SHA-512:	7CBBBEF742F56AF80F1012D7DA86FE5375AC05813045756FB45D0691C36EF13C069361457500BA4200157D5EE7922FD118BF4C0635E5192E3F8C6183FD580944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u.3..........." ..0............../... ...@....... ....................................`.....................................O....@..T....................`.......-..8............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B........................H........t......................x-........................................(......(......{...."..}......(&...:.(&.....}...."..('.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(...*.0...........{)......(....-.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\SharpRaven.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117080
Entropy (8bit):	6.406215603644869
Encrypted:	false
SSDEEP:	1536:WKKw4TfSgLOwanNdGzV9P23rl0LnITwa8yNpgwoIhAm7lPxHPxS:WKKBrbanrp0k38yNumrZxvxS
MD5:	89A2762F19597B82D5C501366E5B2F29
SHA1:	F5DF7962015164E4BFED0AE361F988C1E581677E
SHA-256:	A236377DB9EE299087C4F8FA6E345765AC4A25AA5D7FABFD8B724F1889324167
SHA-512:	BD2A4AB78835092ABB0CF3CAE0850C8B2AA344247F6479CFD59D52BBA60C4B605ADA4BF885E1AB0B86D4FAB138A9084900B954E62E6384D794F2CE61C999CB13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~..........." ..0..x..........N.... ........... ...............................I....`.....................................O.......................XI..........8...T............................................ ............... ..H............text...\|v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B................/.......H.......,................................................................0............r...p( ...t;....+.....0...........~.....+..".(!....Vr...p("...u............0..T........(#......(......,.r...ps$...z....s%...}......{....(....}......{....(....%-.&r...pr...ps&...z}......{....o'...}......{....(....}......{....(....}....rQ..p......%..{....o(....%..{....o)....%..(.....q....%..(.....%..(.....(......s%...}....r...p......%..{....o(....%..{....o)....%..(.....q....%..(.....(...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Data.SQLite.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	5.986532957924007
Encrypted:	false
SSDEEP:	6144:o4xtlRVuJ4v4pFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cb2:Vljdv4pFNFaFeFOFwcGF6cmFWc0FWc81
MD5:	AE8E6840BCFCE9AB0F6DB77A5F60CA1A
SHA1:	0981E864217C2EC5C67CED185458010E4BEDAC6F
SHA-256:	DAFA4A7E1186E5FE8223317F654795B9142D72917006EDAD03EE3D1DE5162BC6
SHA-512:	B3C3EA043CC8A286C9B7684FA7402534E2AB61D3EA9605CBF65EF88E1AF13A2EFA4E4911C2BFC1518B33A315D098E72CEBC04F8B47967ADF6CFFA2AD7765F5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I..Y...........!.....<..........^[... ...`....... ..............................7.....`..................................[..W....`.. ............................Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc... ....`.......>..............@..@.reloc...............D..............@..B................@[......H...........8...................P ......................................1.9v'.J..b.r.4.t...,9.p\|.A.....a.....tl..........i\z9......Q.uo.x...O...a.#..I........h.#.\.3f._QA8No....YR..J.S.w..O. ..1:.(......}......{....:.(......}......{....r.(......}......}......}......0..5........-..~.....o.....X...r....~.......o......o .........6..(....(...."..(.....0..T........~!...("...-..-.~#...../....+...X....($...-..-.~#.....r........(%...~.......o&...Z.~....2..~.........

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33256
Entropy (8bit):	6.470050941710262
Encrypted:	false
SSDEEP:	768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
MD5:	82DEB78891F430007E871A35CE28FAC4
SHA1:	4E490D7EC139A6CDE53E3932D3122A48AA379904
SHA-256:	2F141B72A2AF0458993E27559395D8A8CDB0B752D79B1703541A61E728B55237
SHA-512:	E47F741AA9153CFAFC5F6BE39987D7C7D8FB745566C4D9A4525B9F30CBE6DF450D27BCDF8998DEC7AF824A7BE0F5E9EECAD2A39072B956A6320D23D94A0DA71A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ub.X.........." ..0..8...........W... ...`....... ....................................@.................................dW..O....`...............B...?..........,V............................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................W......H.......4%..p/...........T.......U......................................r~....-.(....s.........~.......0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(...........%...(.....(....,.r...p......%...%...%...(...........%...%...(......0..A.......(....,!r...p......%...%...%...%...(...........%...%...%...(....2r...p.(..........(....2(.....(....^~....-.(.........~....*..0..........~..........(

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ar\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.858496069739486
Encrypted:	false
SSDEEP:	192:vFWrO1dE0+KrkUW1KKrjQl1U4US75iCW5JU6:vFddE0nkUW1KKrMIZS75rWn
MD5:	EF6029B7D20E51BAEA1943A77C3DC2B4
SHA1:	70D3DDF1E97984C3C3A350937259550A1BDE982F
SHA-256:	4E49EBADB49101CFB5DD43670963CDF83E321817EDD3E30196B920DDB72772AA
SHA-512:	5F6A16FF467E02C180F6071CF9DADE21B73DC21669149615EBE4085ED6CA6C506AAD33D76A2F06AF5DF88D066C0CDDE5DCF91CDC51EC867864D9F679EBC22083
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...0.Cf...........!.....,...........J... ...`....... ....................................@.................................hJ..S....`............................................................................... ............... ..H............text....*... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......lF..............P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\be\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.772933178977623
Encrypted:	false
SSDEEP:	192:AJDDr3NDR1ANbb/UmTPM1gzh5fm4qT7w6:AdrNsN3/ZTNfqTP
MD5:	DD199D4D28BE1867F703436CF7941ACF
SHA1:	DBD8480E1AD0EFD8A935141B5D6A902CCBEEFD21
SHA-256:	11DED66BBBABED71A3E12438DB4A943CB2D33101BFBECD4C0DDE848784640719
SHA-512:	F56B26A82EFF4DB5BFA3F8275586A2EA8DF05A5B5CA448C17E9110A257417195F073E1A7E6405EA2CE46FB57301A7B9C606C93FBC2471AE855581DEE7B399578
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!....."..........N@... ...`....... ....................................@..................................?..S....`............................................................................... ............... ..H............text...T ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0@......H........;..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....7.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\..b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..GO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'.m..it..t".\|...\| ..}....'...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\bg\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.354608335089476
Encrypted:	false
SSDEEP:	48:6HzCHsX9s3KewzhdUGUzj8LOGuGsL/3z2lGVjq+bca1o0lC6GL3QUaNF0wEyGwLV:+CiXUGUzjkOGR+/D2leWOo0lC6J6
MD5:	388CC468547A4057D6EE40F8C9B20620
SHA1:	8BD5B3EA5F70D8167CB73C077873D6196008F2EE
SHA-256:	768EDAA425C334DBBEF0AC7471C988AA11F86EBC73DAA7402E8EA61967DD7C1C
SHA-512:	578604284F1151C8A7CA951DAE5BEAAE5E80A190EFA768CDD07F8A7E86C09E3B965F1B2EBD837721AAD198BF8DFECB3F26AEFFAC87FE6A9F321367415296A073
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!................^/... ...@....... ....................................@................................../..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@/......H........+..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........u.j....;..\...9....#.............k......F. ..:3M.(DO.6Q.i4X..]9Y.`.S.l.[.m..t".\| ..}\...............`...............i.......s...'.../.......R.......................5...T.......f............C.a.n.c.e.l.....<C.l.o.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\cs\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.764379673113224
Encrypted:	false
SSDEEP:	192:jFWryOaWd4rTLsglVXlpQd3Rl527a4XRLVWp6:jF/ZFrTQglV4dhliBRLVr
MD5:	6C569A5D39B41AC467E818AE3BA431F5
SHA1:	036F7538892B1D1EC0E49E43A7638D9A5459D064
SHA-256:	2D7E936AE8D23CF03A1930C4618E73E35696BD25696727A7C08D2D4AF21611B8
SHA-512:	123FCB2A2C35183FE9BE50586599743002D334FCFF94321197063FFBBFEF6827E87A6020C865E811CA78A66067CDE92E99DD25F11BAE39AEB101C9EE9C2FD587
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.....&...........E... ...`....... ....................................@.................................DE..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......HA..............P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\da\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.507253055140553
Encrypted:	false
SSDEEP:	96:qlgSDCrKn6rwrmwYf3qKUfXyZA3hyMjw0U1TgSxyRFdZRHI6/Q9F4CIKy7D3usRY:AFWr7EmwPpU9u8yesRJG8hH3s/RG6
MD5:	F24693D9ECB428A17990EC764C804A25
SHA1:	343066209B5E3A0F9CBCB640FC35DB5A4C5E319B
SHA-256:	4F70D98AE9D40F0B6E3F1F044F815343AEF44CDFAE3BF27AFF77E3A1B953298E
SHA-512:	ACFB18707010D69E119A0A0F690F7352FC5BDB2AEF61C9560E92259E0E12CC6706BB8DBC2C155AC5E7DDE06E99B01E6494DF4714B79F64DDB8B493D982CD3E9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.....&..........nD... ...`....... ....................................@................................. D..K....`............................................................................... ............... ..H............text...t$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PD......H.......$@..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\de\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.576984355325907
Encrypted:	false
SSDEEP:	192:5CFWry2KjE2u/FAxjqFIDua8x2Zl7vMeQy26x5E7k946:5CF/jjE2uCPE7+
MD5:	A34E874D7CFFD93CE22FA204A6DF27FA
SHA1:	A34E21425A83F872FCE9604B0FC06DF96BDFE7DF
SHA-256:	09472CFBE0C0BC0E79FE451142974300D9E9B5142EF945FC8218E33BC636B7CE
SHA-512:	3EFE1DE8B55067D0250FB813B63456941AFF1E50C3ABF5611AF7920311F218A447FEFC198F9A4259412209CB2DB702E791F905979CAF5A692C4A94CADF355FCD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!................H... ...`....... ....................................@.................................LH..O....`............................................................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H.......PD..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\es\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.514356574250874
Encrypted:	false
SSDEEP:	96:WgSDCrKnsKJtKDZHc4mNVTCGWjFx0++ibyQXCRUD5Rg+eRk33Q8JC7301Z/g7LX2:WFWr2tKDWtWHKE1Z4Ei7a06
MD5:	FF5526260DA420C6C12B67FE62793B22
SHA1:	50C6644E3AE249519024E9100F1FC09103351A0E
SHA-256:	1A157118AA7D7D4526A8B3A07F8AF63A861630CD6E003D3AE6B86B648ADA216D
SHA-512:	21DCF66A7E81AB4B3B3CDC0E789AECD49D0957E315942044AAC54D2CD0819247A5DF3D9085E17488A5C38A8D0F8A8B82DD0D70F6FAEB4E33D288C5A650E986E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.....(..........>F... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...D&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................ F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fa\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.14844069796407
Encrypted:	false
SSDEEP:	96:+GqReSvKGjBo+r7Rxc2naDt9DF0lC6k6:Z6ea6JWa6
MD5:	7B95A4517F28C7117AF6B5BE639E6B42
SHA1:	A83AA9B3B82796079F6C4F868E08E1C47FD9B772
SHA-256:	BDE8B97D808FA67F7412330D19E8F79428B72C4823E78AED6D5A845658E3C4E4
SHA-512:	DE02FC2E21FCBDE6961B9545017C6C06BB2A28E2C73E01335B5892D0D3D1B3CB830903D4E54700B221AE80BC40D8032ACA0586B75DE1135ADDAD590F093A8D0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...1.Cf...........!.................0... ...@....... ....................................@................................../..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................./......H........+..............P ..i...........................................e..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....../....u..;...9...7...#......... x...n..d......k......F. ..:3M.(DO.6Q.i4X..]9Y.`.G<c.0.c...j.S.l.[.m..t".\| ..}....P...x.......................x...e.......k.......................a...Q...........J...................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\fr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.622514818117589
Encrypted:	false
SSDEEP:	96:wUgSDCrKn1YZ3ranOJA9TAGnJIjQhtFqIaFyGBARBo82YZ1fdJjR1DT48+KjrAil:NFWrv3CNlPfXjXDEjKjb0R6M6
MD5:	760B1D3F776AE9A6F85E8D11B3F7ABAD
SHA1:	425C42A4C163A52E98B2F04FBCEB108EBF55038B
SHA-256:	C9E204AB98A72E681E78E221BDBCF4FDAB30D6A377819EF2C87E00CBAE5D7B06
SHA-512:	2C0DFB1D67B4D28F4886A44ADEEBC53D6E39217811CEBBA1D23842AA5AD32B9269B295FC2B50D954763D17E5A64D1831E49CE0FCC5B436D4EFB8BE2BABA83D40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.....(...........G... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H........B..............P ..q"..........................................m".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\he\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.596847872672188
Encrypted:	false
SSDEEP:	96:w1zMfqLXuAJTptO1zkjQHtIjZMronyMwRBQDKqNTt04uLV8A92jqb5vZ3+0lC6QG:8zn1ptuuTt/A9P9vZ3nC6
MD5:	3CA2183DE404836DD8FF71FA71683D18
SHA1:	5DB1F56052FAD084C80FE0A3A84A5C3C0EF091C6
SHA-256:	F9CA78CF49C9C575F26174B1C37745DAA53B60B8B22EFC7A31895BA67ECA7772
SHA-512:	93423F44640DE3B144ACBD478923F45303889C4E8381685D8B28D9870BDE10C8BF3D6C421BCC1F08B1CEA309F8C4B7580F2CF9F4DC0FCCCA70935B45FF145C6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!................^=... ...@....... ....................................@..................................=..K....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B................@=......H........9..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....8.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d......k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}o...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.537044927253244
Encrypted:	false
SSDEEP:	96:wlhBUgrdJNxp5TkVe/nY9mjenCnUBbyLHRQ+dyJThhdBTRs2THhXCfQknQ9YvtfO:ghBUwNxbcJ1hf6QE0YtdjdD6
MD5:	A77338FC46EB081D377B54A2D4D58568
SHA1:	3F57ABA7BCE46D7B0E1218AABE7DB83D89BD8530
SHA-256:	772AB1466FA9C2B250A507E972DFEEBA8B212A0F58148994629A6A5E5211AB1B
SHA-512:	217FB89445370B359A402D441567452C0480E797BF0E92EDAAC1CC9C5F85F34B44F98933AC645716A912F7A292D9677E85CE55EE1DE72EE7A8217ED8498C7716
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.................;... ...@....... ....................................@.................................d;..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......h7..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hu\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.561596673863613
Encrypted:	false
SSDEEP:	96:w+BUgr2b4SPKBIEV/Yy9jygjgqyo1RB5Ta6Mi0AHkxnteOicDiE/a1n3E0lC6QF6:zBUN4SGf4JteO161n3J86
MD5:	D839579A18BD67BB3D6067D40B8BECAA
SHA1:	405091A2BF3D6822C97C92F1FEF2A58A243129AB
SHA-256:	BF1D0CC3C3371D03004EFD7B24B77A2026CC7C602E1075981F3112D94C6EC5B9
SHA-512:	AB066FD0F13176C01746040F22DF5566993B90222E92A2DEE53A49368C9946DE6FBC6053A7101F2B496E42C81429DAF0E036A1D00EBEC0B4ACC8DAFA0ECD2599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.................<... ...@....... ....................................@.................................`<..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H.......d8..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\hy\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.129446179243231
Encrypted:	false
SSDEEP:	96:worqj1c+hkaHQjb5+KR2lqZWn10lC6Qb6:ZA+vtKq4nGC6
MD5:	EFBC7D9A72EFDEAD7F3295AB8373A363
SHA1:	68C5901FA22465A6C16AFD6BA343BA187B37E2C8
SHA-256:	98A99D707E4FD8D33A7FCAE42952B35B736CA5F960CB5B8841ECB66BE224C848
SHA-512:	377D7A82745B3E3B4C9356FD39F6C2E12AC718BB19A1B66DA6150927462855A62B0C5D160E85CAF8D2A5835DBF31E9DC705197D91AA3D8AECF2BDE0293C9EB0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!..................... ...@....... ....................................@..................................-..W....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H........)..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........u.j....;..\...9....#.............k......F. M.(D.i4X..]9Y.`.[.m..t".\| ..}....................]...........R...{.......................T...S...*........................C.a.n.c.e.l.....<C.l.o.s.e.A.p.p.l.i.c.a.t.i.o.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\id\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.378579357988375
Encrypted:	false
SSDEEP:	96:wlVTybtPdK35lWTy1IHJmjBUJtPyrBRqrTrMimTvq52p+4xMR1oqjL4eDf0lC6K6:GVTybDK3tUxqi52p+4xMR1oOL4eD8Q6
MD5:	B418208DB33E48A09F34F7EEFDF3DF16
SHA1:	04DE3B5AB03EC818165C9F238B9B12FA95734177
SHA-256:	C87E3E7C6F5B2814BF3506B97AF31252B92A153E826EC4E2A461913437DA682A
SHA-512:	6309A9261E1BBCF69BB56239520A3C29ACD5B9C9E3562D64FCBFD958963764A5749FBCB5DB6A6475ED306426F2A1CD0A01E5EC725179E320D0C6DCB5BD4369AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.................:... ...@....... ....................................@..................................:..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................:......H........6..............P .._...........................................[..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....8.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..GO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}5...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\it\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.542393470126645
Encrypted:	false
SSDEEP:	192:1FWrQeKoFoM9MUbR0EmOXzBz5sgcTmgB386:1FAK6o7UbR0EXzqVBv
MD5:	6E0451823B2B83A7B0FC273A96A05CDF
SHA1:	344927B8BE14513059E0ECED8F5CCA710E7A4639
SHA-256:	59443A62231EBDBF28C3A6CFD903E369161CBCBB363795E88A23AC5F42D42899
SHA-512:	3E6FB6A56641A0B83445D9211B4092F79357CF2DC24F6C447254006DB328FC4916435035A52EE899B0C95D16184C362873DE7CEFFC03E6B9943CB3C397CE4CAC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...2.Cf...........!.....(...........F... ...`....... ....................................@.................................dF..W....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H.......hB..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ja\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.1435311694632535
Encrypted:	false
SSDEEP:	192:dFWrzw/X2XwshtFMgZIioP/s2YVyNXEbyh7SpTw6:dFb/X2Xm2lVQXk3
MD5:	68A26FA5D87BB7B92B17B0810C765C4D
SHA1:	9A81FED55F0DAC2E9BAD73F78E9826DDDEF0D20E
SHA-256:	A48E2E4622C36B3AB685A548B9B4D61BAC866A960B9AC2057765C97F38259D22
SHA-512:	11E7BAB888F5C3590BD254F0EC9451752CB343D7AC9111658BCC627B81D281E3D457DE48E93E90823117F5B4B311F72BA92302C6AA584608EA31750EDACE61D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.................L... ...`....... ....................................@..................................L..K....`............................................................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................L......H........H..............P ..c(.........................................._(.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ko\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.074458214104735
Encrypted:	false
SSDEEP:	192:mFWr9YAjE2TCDZ1taSA22BJzyIJ6xylXfXq6:mFNAA2TGDaSARpJMiXx
MD5:	8717FFC7ACE50175EB4350748FEA0EE5
SHA1:	0E797A1C1419672166DCA7B8B1AC033ACE6FA165
SHA-256:	4B167E9562269D493DEEE71857F0456A4A5E572F0316E93D798598E7B1B11113
SHA-512:	E44E9C5FA2F805526C15F05C89DBFEAFE674C8DAFEF047CCD3786B20418607AA4D939091C3BA48CA027DC0656CA03B6A84C18D81C5EF071F6B9B0CFFCB77B1FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!................H... ...`....... ....................................@..................................G..S....`............................................................................... ............... ..H............text...$(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H........C..............P ..z#..........................................v#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.070412664469304
Encrypted:	false
SSDEEP:	48:6VskHQHlXONEo01G8+UPU9XCHA7ke6k6WDAR7Z0lEsRPJ1Se6Bffs90w63XT8wfI:zk2V0l9ygg/kpOelE43mffW
MD5:	42E4C8538BDBDAF9E6EEA04170A30ECE
SHA1:	7E1618E919940D628A129701DB72E5FBB0A0759B
SHA-256:	C7F9B280C936628D6862B4058B76904ACB5203B04BB0DB055AEA8087F467C443
SHA-512:	A1D901E283EE40BF502C5D4BA32799739F8E959AD10D4696E0049253390BA0C8AAEE3E3E902E2AB3C680E21EF047BFEEDE4993F9AA0528783AB1D100AE5BE3D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..f...........!.................... ...@....... ....................................@....................................W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ..........................................T}.....j......j-)....4V.3.k@6.P.VX7.u......4..7..yV.\|.....vG.dS.....'.hsU.<..#..UM....'.......e..JN....?Y%........l...'..)...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.da.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.93118173589459
Encrypted:	false
SSDEEP:	48:6EPoGxqzHQHlXONELRqt8Hu49Xl0AGk4dKHb0a2xfqo1/Z0lEsRPG1Se6Bfns90O:BoGxg2j4W91bdbH4p5FwlE4umfnW
MD5:	E24B481325CB69CF39B7817E776DBAC5
SHA1:	949D8447D6FB2422DA8B6014BF215C8180493705
SHA-256:	86A8E278CD0F2EA64D16D55E183452D9325E4AF8F83F7A64C8F52741B3BA011D
SHA-512:	DE89364DCEB6F023FA837F428E3006F21D7A969A640E0461028CF2AF97E25B97F24F0EC8686C3BF4C02725230AB0FB278CF4DCDA3363EB889FB4A1E2D74B3588
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..f...........!.................... ...@....... ...................................@.................................\..O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......l&............... ......P ...............................................5:..).....r ...x.......O.Z"l4.#!..4C...r.R........m.OX.5.."p..&:..Fl..GV./..T)v.L1Jp...25.....h.3i4`s..7t)...x...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.de.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.068406925189331
Encrypted:	false
SSDEEP:	48:60geIHQHlXVN+cGuPI8otc+HW9XYYAVcDlYw8K3wZ0lEsRPaF1Se6Bfws90w63XO:VI2MughBW9IXElYFWHlE4y7mfwW
MD5:	8463D83E3DD30F47D7F5FB3BB334B40C
SHA1:	5FED0096E8870E8CB6F85117BAF879DBDF0B4C3A
SHA-256:	C11CC9512EAA3F08BCDD203ED76C38EAFC5B099301CF0735695C9495A6C134F3
SHA-512:	FE080390E65452A9F7957B3DA9E73167F7BB2EA71BE98870BBA72F16D85F1604CE082CDEE64186DB2D7BF8A6C74EEA17782ADDFD8D8FA5EFF2702BDA0DFADF32
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..f...........!.................+... ...@....... ...............................t....@....................................S....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ............................................E.M....=&...u..q.F.}6....../..=.....q.w...o......8X.ZD...$.....z....p\|A...j....k...x..o.{.......!.l....M/..(.......N...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.es.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.082872406747305
Encrypted:	false
SSDEEP:	48:6HF2ynJeHQHlXVN+/87sEC8OJc9XUkAbDi4nhQnN98Z0lEsRPr1Se6Bf0s90w63e:9yJe2NO29kr6qh2rrlE4hmf0W
MD5:	40A68634281A56F85EC43BC84495C925
SHA1:	901BECFC32DBDCCA3F0ABE5A0A9863F3AC6280A1
SHA-256:	66857AE9AFE7608A89969A789A041F4360CDB7BBF7C8680C7598C28E4673EEDA
SHA-512:	034A80138CAFD720A6F3592A1544E74F6A19BA02C92CD733CF5E67432C764F3551E67BEC27DA1C542AD2CB7A0415A0A9C17E8E92B7349AA17D996EA5890225C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..f...........!................>+... ...@....... ............................... ....@....................................W....@.. ....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ +......H........&............... ..$...P .......................................M.....Y.'.....'.......k8..7.T..T/.2..\.._4.A..9+...V...x.+....&.>..}(.'..4..4:..b.4..IH.....Q....).....L..l-..'....UoY ..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.062576637150197
Encrypted:	false
SSDEEP:	48:6nnR3HQHlXVN+y27sBC8OJnWu9XOu+AUJpJEvUTROtqbjuVVhse3Z0lEsRPf1SeQ:q32CTP9eMNSROtq29svlE4VmfoW
MD5:	B379750E626191055E2230696A5CC11D
SHA1:	541DE4F45212A3EF4A601CAAD3A45AEF8F401F20
SHA-256:	0BA158C64B6BEC6A3467F8E9038124E3642128CD34A40A32F0A757F2F5E5EBB5
SHA-512:	D5EDEEC95286448B03DA3067AD5B5CB2BDE7D9C8A37950FB7C51D1615ECAB4755820F03F5C111DD29144E0833C44DD9D64BCF57064BE50487A836F7924CA76CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...#..f...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ..........................................@......:.G#1...~'.WV.;6<...Q:?..Ca.l.;......V.w...X..cf....Q..T...........@;w....C..8.6.....2. ....]`ma...W4..N...t.................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.it.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.03918555963053
Encrypted:	false
SSDEEP:	48:6DDc3RDBHQHlXONEosS685ew9Xia9AWkWVX7mBaIcUQNZ0lEsRPju1Se6Bfjs90O:8oB29jQ9SaGNnhc2lE4LemfjW
MD5:	4EE63E9E77C0CDB28AAD608105998491
SHA1:	1DE79153120F2879E3BB7D4441BA00FF35518670
SHA-256:	04493BA76CEF0F147842B7587BFA39CC0F6F6B02ECA628AB79E6A61BD0B5944C
SHA-512:	3112699FF6BE4FE66C028E55215A230802FDAF22C9D82442017B19B070BB1FD489CB5628F80D3BF0AD1CFF48FC44C9AAEE390FECA1ABE1E76D8A5DCC30CA91A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ...............................................s..j#..^../....a...?.v.Y.E..t\|..RB..1".......2.P...^D<Z"=`.....9.M.0h'.{..]&..FR!..R$.`.N.h".._2.4.f+...2..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.438569076523074
Encrypted:	false
SSDEEP:	96:8QeiA2K1DHD9iqjqQEacyYpVq3flE4QmfoW:jehdhHD9iqjXETyYIC47n
MD5:	12DD224510052F57D31D5353C2578368
SHA1:	42D420B76713BCB4111E0C4D2B71C096E510FBE7
SHA-256:	E7AEF93CC6DC908E9D12989C8758BAB3B74CFD5CD7F3C2EAE9873B9454FA182B
SHA-512:	9F8742418BE556BB16C8F34FBAABAF11AFBEF89FDCE09913FBE063E0B85E03B8BC0389BA7FF4E2B876ED1C4B90197828FF8FF875474EE85FDBA3E095A0F6E094
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!.................+... ...@....... .............................. "....@.................................`+..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H.......p'............... ......P ..........................................6...lAk'y&,.{.V.D.mR.h.tY.....wm.4c..Z..3..tm..&..-.......^.3..o.t.p....h._a!\....ij..^..x.}.....#{...}k]...........^...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.299061662650153
Encrypted:	false
SSDEEP:	48:6DDMVH4HQHlX7NyVj1oDT480Jgq9XBaAlCkt8/L22lb7YYbZ0lEsRP5jH1Se6BfL:8926poQp9RRIkbg7Y/lE4B5mfAW
MD5:	3AA4CAFDE01F10AAB8B76DEBFB88A5B1
SHA1:	BBA088903B6B1741F3109D7A4AF874E556A6EF8A
SHA-256:	4AD001DC301B0174567E6E8A86E3ECCAD4CFD32523441FEA7ED5F4FA0BE7758B
SHA-512:	3B0CF138CE90C60F086F94A62B8C2C0C346D9410E83AD1F01E65EBA8AC5D8440910BFCB22176C05B63F936285BAC2B0F4A4B6E11E6B4B4C7BDF8179D3E939D98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!................>+... ...@....... ....................................@....................................S....@.. ....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ +......H........&............... ..%...P ........................................E.gl.(.BZ..{..'.~g>W.".`..!".=.../.LgaR.=.......@J.F8X.I{.....O...u}.a.>l...wS{...u.{.&%}...G'......uB......,S..U.h...a!..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9875113412696703
Encrypted:	false
SSDEEP:	48:6DDqqEdXDXbHQHlXVN+cz2E8vc2pb19XTgAub37HVSQPWoy5RAZ0lEsRPjb1Se6I:8XUTL2Bh419D/uXEysP3lE4r5mfTW
MD5:	49E9AFDC05E21DB52D35836EF382F724
SHA1:	1A87661EB54D6742951CC74673E769FF11ED0BCE
SHA-256:	88C86A31BEF5F0B50CBF342749C51E42958ADCC2F83AD8E05AB2DFFD9FD7FF65
SHA-512:	4673620EBEDA4CC723F45771C347D5757E38CFE5BA536F57956BD158A47F4154ED7DA9C98909FF61440FC2A564896EA26ECEBABFFA0FB9B3977927C49B58F85B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$..f...........!.................... ...@....... ..............................q.....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................9.+.....^.t....H...].[1.o..p.-Mv.....O.U...}.l._[.G..y\|.../...)..f.u.X.LF\..I5.O-.+....).c..(..A@...o.ax.~qp#p...T.O..]e...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05224128243754
Encrypted:	false
SSDEEP:	48:6QKvkHQHlXONELGKE84zp9XYtAokiJrnyOlY+gZ0lEsRPMR1Se6BfDs90w63XT8/:yk2M9H9IW3syOlYalE4smfDW
MD5:	F5BD1E37D61DC121B4F07D4711023F7E
SHA1:	556F4A3305C6214F15BF36048568BD2EE7388879
SHA-256:	9CE7A9D7197CF382138EF1E585CFC67D08A0B5940B5F87685EE122ADD9BE0889
SHA-512:	F4CC41E1BC623AB08FDB32EAF44484102817F7B629DBC61CAEC1D948274C8A633F39629ED666B0E783FF9EBA9E889DBDB2B4E48BA7F54A6552CACEA695756071
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................... ...@....... ..............................`\....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P .......................................F...%).K..H..{...J}.....H.F...g}.V.T./.8...>....R......x.6Z.;.{.6.AP#..R.z.y..!.I{..." .I......d..h.....=.A.....E.u....O................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0548170504617085
Encrypted:	false
SSDEEP:	48:6QWlKLJeHQHlXVN+/FB480fB9XXgA9Dah4elgQCkhRO50lEsR+8o1Se6Bf/s90wt:rte2k2X9H/27nC2RtlE4Emf/W
MD5:	26C0E4235C67DC354BFF94EC95D4DD6B
SHA1:	E11E32204CA626768406BF2EE8661C5A6ADB01D7
SHA-256:	8ACEDC2916603A278ECAF7719A277A36A7362739023C8CE1E0AB42D97BC10D68
SHA-512:	DE42C4AEB0712D5D56D49861A0F002B61C6BB738B285820414588DDD83622F61304AEDA1BB49BB170CFCCBD30C53000791002E2660F4016DE904905441BA0D5D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................+... ...@....... ..............................+(....@....................................W....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P .......................................P..e.c..uT.c.d{....+.i.#..OT../..L..`J.vv..Xju..8..!.......0..2.ffE.......-..C2$.)V...r.1.2h.{.U.._.p=..kfX.._.@..('.i..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.048592937646518
Encrypted:	false
SSDEEP:	48:6PoiHQHlXVN+/1od3lpc88jLc+9XLl+AhDk7QPkhRO50lEsR+CW1Se6BfXzs90wt:22aod3laRh9blNpP2RtlE4KmfjW
MD5:	8E04A4820F073A6CDB5CDC08A549332F
SHA1:	B9CA3C1918FD0B68967DEFF2C9C47C089F5E6B96
SHA-256:	0D0762D0C1E7C0C73353553337CB835C1B92879394600137C33CDF5F354C416B
SHA-512:	906A06122AACBAE7C00266F439B85A109128707EA86DEEECC7452A6BA2B085C0F838E5D6434E7AE6CFDDD2365672DF036F60C558246678FC242148342CEEADC1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ......................................l.......5.W.Pc.I..t..v..r.Tj$..).8.......i.2..i.n...d.D...........p#.m...k....z1...L......t...E.-...(..9z?q.x..M..S..ly...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.156219234297824
Encrypted:	false
SSDEEP:	48:66trPj6UgHQHlXnNgZXyrubV850h9X0aKAvuqRwx9UqBE1LcNXH+ILZ0lEsRPl7T:xW2g4rupD9XhsQqyebOlE4t7smfQW
MD5:	D8E8BE64281A57443D47C521B40D84BB
SHA1:	367C6DC19F4357D47E3F6CD675A76E247792F553
SHA-256:	91CE4CA0D1BE1CD3B9089A24195183069F25A708C1D746D3DFF960F59B5396D3
SHA-512:	616C3D011DB4A36AF7AC5C007843C7E8EBCE7A075BE3087A9946A833903C38D148FA94BB4941837D2AB1E90A343069B4F625D821CCEB707B494000240CC82459
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................,... ...@....... ...............................i....@..................................+..S....@.. ....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................,......H........'............... ......P .......................................W7..r..q.dQ....+4...6I.5.H<.Y...j.U.J3....#.m....Uj...p..E.=..6Qb.C"G..#.%...$...N...%..?...4..n.rd.p..#........d...................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.080918503374663
Encrypted:	false
SSDEEP:	48:6Fxd5HQHlXONEVHg7Q8NkjWu9XPJA2k8it+SEVovWaCZ0lEsRP+VH1Se6Bfzs90O:U2//39fKtb0nVovjlE4WVVmfzW
MD5:	04F215F39174F685D97944543FF1504C
SHA1:	79336540EA595603E8EB70FDA775EB58A4617118
SHA-256:	4E7FE0ED22DA1ADC3465296D7518DCE33FD43F4ADF0676177F76727A31ADE446
SHA-512:	31E6BC062628C8F9DB633ECB96B1AA5C9CAA3502D92AE41C833B8B61BC8129C7E77365A762E2CDF5D50963935810EE4B5583E8826D6C5A2476891D09011D0EC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%..f...........!.................... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................v..U.;.e....3..^...b.Tzx.9..r...\......\|.).D.....9....x.....6I.\N..~.H......'...}Ln...S.KPb<...W.....)...S.<..a .f.w.....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0290727379888205
Encrypted:	false
SSDEEP:	48:6MKB83CHQHlX7Nyo3Hz8olXgp9XHVAWOyqQlYAA/iDQrZ0lEsRPW1Se6BfXs90wt:YeS27Thl89XeelE4+mfXW
MD5:	3B54570D6D6724318ADC3FDA5325D28C
SHA1:	28950B3565DBF877564DD40B61D10F4D514EDFA5
SHA-256:	223070A04B6E5E551BDB9CF9D2EABE8C3D0D1BA39AB8032A3B7C1900DF1A2A7D
SHA-512:	913B587AC593E1A43A67392DF61634DC20B35D54815AAAE0C6ADDF90F9999A7663AE1A122BDC59D6EF61B72E266562D9D4F6B800B6993862FF1DCBC59AB166EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..f...........!.................... ...@....... ..............................,.....@....................................O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................JL......,m&.....1.~.T.....{c......J..;"".:M(R...+!..$....5 .@...Q."a....OK6..9.KL..c.7.\".[H.5.D..f..s.....28b....z'.7#..&.g...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0836365128627055
Encrypted:	false
SSDEEP:	48:6KaqfDHQHlXQNg/mpo89hE+9XPZABiLlFFOy2dR7iRZ0lEsRPGA1Se6BfHs90w6O:l72K+w9f6BGl4F5lE4xmfHW
MD5:	479C987D50BC134FF0773B5B79447040
SHA1:	A4F3AAF56086EFEF69682FF9C6E168A7D73C3EE7
SHA-256:	72FD45BD5D975B6540515CC571068F34E172A116134D0A7F55110958BDA2BE35
SHA-512:	768D2E922004D54E23C1DDDA801FE6B115E38198ADB4172E8943DE36730A221DE134471EA2584A041CF31339B5E0A74E2DFF978DC6DC02F10856EE58DCE199FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...&..f...........!.................+... ...@....... ....................................@....................................O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................!Q...G.GFx../{...5.9`.>..~.W.SG....b..\|5B.i..T...!...e.6...R...%.r..J....,u....~.....M....g....0.p.yv.& ..va.s\,\|.l/......^.V...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.2355557611221535
Encrypted:	false
SSDEEP:	48:6w5bT2HQHlXONELhb4+8nKfq9XUeAz6k6AbZ9ky3eBy1550lEsR+N1Se6Bf/s90O:y2TE+fi9ktFpfr3olE4wmf/W
MD5:	67D2B049B042F06E131F4ECC24CA7CD1
SHA1:	C910E31EC1569A1D0D09E9DC311DE54C006BB288
SHA-256:	2AB92367370CC3E9CB64C1394249D0F5A9112740E6097C58529FB232E75609F8
SHA-512:	F1DF4EE9390E387F3B5DFC5775FED089138662F41D551E6EFAFBFBFF84A5663D83482414C6FB3E4369FB17F2F883C75351E9F534001C3C8C16DDF5FFF9F8B3AE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'..f...........!.................... ...@....... ....................................@....................................W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ........................................i..N.>.h.....").F;.,.Td.k2...w..}.....%wQ...... :o..V.....!q..>U#..&.U.{.........a+.?.j......8e....\AG(\0.!.._..P...4..F}...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.199486773906579
Encrypted:	false
SSDEEP:	48:6JEGHQHlXON2NsOVp+8CpTL9XFMAKSAneELusDHYZ0lEsRPru1Se6Bfvs90w63XO:bG2WOiN9VzRuPlE4DemfvW
MD5:	0617F841FAA9113634392278A28CE05E
SHA1:	6153BC5E9517A7183ECB011CC8D19C4579ED27C1
SHA-256:	2CEFCE0265AB3DE45C1C55E5A596D8F3DA819EC9651C41F93C108E4D6DD2F014
SHA-512:	6B1D473D98A5CF3CE9F4350D06CC5CEE9F02EEB3BED0AC8EB3ABCE3ABB5D04621C98D6C116E63061D7C9F0FE032AC2E971BC864218D7D094E2B13A9A016DF41C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...'..f...........!.................... ...@....... ....................................@.................................t..W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ........................................(t{.w.....={.L"i...e#.U.N.]I.1{_........a......i\|y .4.....4P..Lm....^...)..:7.M.>...^q..X..D1K..e.;OD+..?B.A.]../Pn..^...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbahost.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122288
Entropy (8bit):	6.643662045821993
Encrypted:	false
SSDEEP:	3072:iyjfrCvv4JR5zsemsABCF0TPSLNegl/+b:xrrCYRsehsIX/E
MD5:	C59832217903CE88793A6C40888E3CAE
SHA1:	6D9FACABF41DCF53281897764D467696780623B8
SHA-256:	9DFA1BC5D2AB4C652304976978749141B8C312784B05CB577F338A0AA91330DB
SHA-512:	1B1F4CB2E3FA57CB481E28A967B19A6FEFA74F3C77A3F3214A6B09E11CEB20AE428D036929F000710B4EB24A2C57D5D7DFE39661D5A1F48EE69A02D83381D1A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v........................}.......\|..............................o..............2~......2~......2~q.............2~......Rich....................PE..L...Tp.]...........!.....&..........(>.......@.......................................;....@.....................................x......................................T...........................H...@............@...............................text....%.......&.................. ..`.rdata...s...@...t...*..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188848
Entropy (8bit):	6.598346436496911
Encrypted:	false
SSDEEP:	3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
MD5:	FE7E0BD53F52E6630473C31299A49FDD
SHA1:	F706F45768BFB95F4C96DFA0BE36DF57AA863898
SHA-256:	2BEA14D70943A42D344E09B7C9DE5562FA7E109946E1C615DD584DA30D06CC80
SHA-512:	FEED48286B1E182996A3664F0FACDF42AAE3692D3D938EA004350C85764DB7A0BEA996DFDDF7A77149C0D4B8B776FB544E8B1CE5E9944086A5B1ED6A8A239A3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:v.O~.c.~.c.~.c....t.c......c....f.c.,.g.n.c.,.`.l.c.,.f.a.c.wo..z.c.wo..c.c.~.b.\|.c..~f.g.c..~c...c..~....c.~.....c..~a...c.Rich~.c.........PE..L...Yp.]...........!................................................................1.....@.........................`.......L...................................`.......T...........................H...@...............\............................text............................... ..`.rdata..2...........................@..@.data...............................@....rsrc...............................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.png

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.648767094164769
Encrypted:	false
SSDEEP:	12:6v/7rW3M/jDYAlFTzdvhKZ7e/cbp4/82UNb6MjmlKPNXheD1H0oJodqSXaTbutak:lQD1lldv8Z7g04/82Y6+Pxi19mDoqt5
MD5:	A356956FD269567B8F4612A33802637B
SHA1:	75AE41181581FD6376CA9CA88147011E48BF9A30
SHA-256:	A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
SHA-512:	A0F7836AEFA1747F481C116F6B085F503B5C09B3A1DD97CD2189F7CE4E6E7EA98F1F66503CBA2E6A83E873248CC7507328710DFA670AA5763DF8AEDCC560285E
Malicious:	false
Preview:	.PNG........IHDR...?...?.....W_......sRGB.........gAMA......a.....pHYs..........+......IDAThC./W.0....P(...Db+q8$.........J...-..8.e]._..;........Y... .Y....z\........{W\|..../q..<%.....C5...0....OrU....,..^........).....2.......i.Ge..T9T..}.7..J.......}..b...S.>.%y..Fc..j.X.....y."...e.U..M(ez....4\..C....u.......w..0..J.Wo."...mM.r.h..8..q..X..k!...j..xn...l...W`..r.+.R..J........c.T.}......cz..<43..@.c..rH...\|..V.....K.mN.........k....,..4OL..5..M.tm%=.U.t-7.w....k.R.....c...-].5~..]2..5...GA..[..={.5..].=(.$}.\.9..5...MWu..[#.....F..j.F...d...,..MWu.7..3......$.......G.t.....=;N<_:[......0.,1.y.\.Z.\|..%..>}...q.s....y.#p......!-.;.6!o.KO..E.6...........<..c..9_B....y....im...b...Xn.....)t9Q...........V.WMtP. .P..Z.&..KR.ac......IEND.B`.

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.thm

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	5.15881451198739
Encrypted:	false
SSDEEP:	48:cecHddpXBT2E/zPHWgtpmAPH8TSJmBP+NPHrM/O8YpQbFUuhJ3PK7usPH4Lr:wHdHxS4Z9UG4BmNjCOhpsB3PswP
MD5:	A20778EC90A094A62A6C3A6AB2A6DC7D
SHA1:	74C131B5FD80446FFDF2AFAD723762DD36621309
SHA-256:	F8C3A03F47F0B9B3C20F0522A2481DA28C77FECDBB302F8DD8FBED87758CBAEA
SHA-512:	47F34A9F416D223DCBF071E7292A05554AF3D27CDE67FC8C161C1BED564C6E7FC448C2F482E05F33149C782E09C681BD65730CA00CF9EC68B284128214B75529
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="mbapreq.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="96" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="112" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.076345322304751
Encrypted:	false
SSDEEP:	48:cxX7DxMT8dbCsK19Wqq8+JIDxN3Wm2WcN3miNlLPDHXsmkaYXfXQ2BmGA7b1fABP:8LuTY1xmmmTerNR0AT1O
MD5:	4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA1:	11577021465379E9D1FF4260E607149BA5DFA6B3
SHA-256:	C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
SHA-512:	AE791C1F05821167F1D2E1D07DBF95FE7E72B35B3E4B1E22720006C7A672B1330B748414792392B0E806F111AA4EFC1C424F4479EBDE349E3F079792DBB3BF47
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">Microsoft .NET Framework required for [WixBundleName] setup</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. By default a log file is created in %TEMP%.</String>.. <String Id="HelpClos

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\nl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.514537996195169
Encrypted:	false
SSDEEP:	96:IgSDCrKnE1hLayI9YnGf3HV7zf4j3J+QYzpyJySRIuZHBH//xxx6npSzXdZuM6bA:IFWrJLIKIOVten6WVtxz1oam24OA/e6
MD5:	51BE3049E0DE8D4F11CC3BD913C1E629
SHA1:	CB978E5CFA7E10E5378506756CA751FDA77FFDBE
SHA-256:	E22A42D3BEF52F19366741F8A3163B0096089AC94D3DA26375BF801F040BE187
SHA-512:	916080E28B43976DD569FD9E39DE6D45DA22591A0DBAEBFB10E5AB55AE2D94EB535F13384C26131432BF640DA8541089BBED2D1F75EDABB859022C56B0083344
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(..........nF... ...`....... ....................................@..................................F..S....`............................................................................... ............... ..H............text...t&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................PF......H........B..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\no\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.035848732135575
Encrypted:	false
SSDEEP:	96:kXSPLaH3wv/82jU96MYugRYuMp9Lxtw9s65v0lC6o6:kXSPL3eppM2zm6
MD5:	D0615BF005FE7A4ACE981A933156B1FA
SHA1:	784F5EC4423A48EEA2E363A62C3B450B6D55CFF3
SHA-256:	2EEA4212F47F9C9FCD310714BAEFD00DD22F1CCC82D34DD6391B326916F539F9
SHA-512:	8E592C057C7351BB88ACDCFF3744E31AC4CE2AFF4BCB6CCF7A0BAF3F9CF8E44FD36D2006528CBD5B096CEBEE09FA15CF87ED5752CA80819A73142D8CDA78F4A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.................2... ...@....... ....................................@..................................1..K....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H........-..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....(.......PADPADP....../..bq....u.j....;..\.......9...7...#............. x...n.(/\|..d....e.....k....}.....F. ..:3M.(DK..GO.6Q.i4X..]9Y.`.G<c.0.c...j.S.l.[.m..t".\| ..}r.......i.......x...........`...-.......................C...........

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.650318035012639
Encrypted:	false
SSDEEP:	192:gFWraoHJ/k+VDjnkjlCQyN3dZdEDvg91NyIG3beIB36:gFVoprBjkjlCQy7zEDv81NrWeIc
MD5:	4B4F338A900DB800B2271DF45BCA26B5
SHA1:	F8C3AD25801B49D80D59C9D3100E8C4B701390FB
SHA-256:	ED60F9E4D9CEA66E8B759D63D92D417E48931B8FF88C0E29FC4F83CCF7004700
SHA-512:	4588D816D86830BEDDC89DFD07A8C8090A07C66DC1CB880968C6235EEDBDB292556880499C576CB8B29ADC0611FBB4E32C1F6BD5EED63A92651F4FC33DDAFB1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(...........E... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................E......H........A..............P ..d!..........................................`!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-BR\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.556427702744662
Encrypted:	false
SSDEEP:	192:l2FWrD/d+TnOqn8CJaedAxC+sKeU8gMZfqJJKs6:l2FYdgOqn7J/T+x8gafv
MD5:	AC4AD057DBCB6EDAEA55A1F40C7557F8
SHA1:	33634728B400D64A6A5AF5AEA7826C36AB6B88F3
SHA-256:	A59193C831B5D6EEB404F523BEEB638B795040D248438ECEBAA17C0F450C5610
SHA-512:	CF4DBE894352391EDBEEA26CC4CC50DE0807B638B03EEF4895F0AE67E2D4AF1FD0089ED0F4A7035F00E61680021E1E0A270D168737B567652430764574348FB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(..........NF... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text...T&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................0F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\pt-PT\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.554067565224853
Encrypted:	false
SSDEEP:	192:VFWrP91G+JnLbOymhU9+wHnA9MDGBh7Jyf6:VFAGq3O/U9+6A9wCx
MD5:	F6DFE6DAA0BEA843DF5FABBB80CC61EF
SHA1:	B061170F0A5AC2EF6C2B9EEDBCEBB8B191A43816
SHA-256:	504F8E1020C8642645B4A26184203B48C58F3F22E5B50EB7AF23B589AF6B787E
SHA-512:	0445AADB8C00B7B4316146BA2A3F535152960FC686F2CA7927574EEE21BB9DD4FEBCABDFED4A3E10438B008936391AF505BD12AD08D05E111C51DF5D53CE8D69
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3.Cf...........!.....(..........NF... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text...T&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................0F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ro\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.394984792490585
Encrypted:	false
SSDEEP:	96:NBUgrr7kJMp3jGUBWBJ/7iGejoLm/S0ynpR9i2PUQzHkmmrY0m7rXf5PEKhtJu0G:NBUKkJWZsHj/j3msrHtESXr6
MD5:	F61FD6F0DA7A4C85DCBC3B5F612B3717
SHA1:	E64E93B9C51A533516234C82D08A43416ADED6B5
SHA-256:	D5A6C506D014C8B4248C3A4421E27924050C265129A5B1B201AB6A37F2710364
SHA-512:	E1D42CB1A0AE98D6B165C2A30033962F98D891B50E1825B72C752D98E0C4F16A0054D0FA3F74BF1E2AFF80C3AF69E911B5582C1480748270B7405ECB34EA4E82
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.................<... ...@....... ....................................@..................................;..O....@.......................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......&..............@..B.................<......H........7..............P ..}...........................................y..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\ru\AdGuardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.981177943200566
Encrypted:	false
SSDEEP:	192:aFWrI71qbtQIcPEPbdUe1SxLu6HnwXfvahc71VGCq6:aFhmQNPEPbdUe4NY6hc7D
MD5:	6B9442929837FCAF82BCD50ED6859F0F
SHA1:	CD61F19D600D360739732B24377EBA19DA3CA2C1
SHA-256:	28F0CB4B60D87C4D8F564A0536BC9B85F5A991340FE08EE8DF5F5765A8398C71
SHA-512:	8E9B933371D399A12AF3FE1095746F967B2EA4EAA050FFFB70E2A6D66D1C04619AE86F46B711685C9D925FF8E2800164A8A63E4922AECC3EE231A8EBEFE23C2D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.................M... ...`....... ....................................@..................................M..S....`............................................................................... ............... ..H............text....-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H........I..............P ..<)..........................................8).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.635973382285296
Encrypted:	false
SSDEEP:	192:+FWrNy6z/3Frstpwriqz1z96Zxl3Ef5lGYVoA6a4OZrNl4lZ6:+FX6etpwriY1z9uc/v4irN
MD5:	875F4E73A888287E47843F0E078DA3F6
SHA1:	4DBEE9CA918E7298452C1D3C3D94C32FEB5FF5F6
SHA-256:	7549461164FD6E6D8D28560D31DC3E1E186B8ABC8BE983FD30F514F3CC561AF6
SHA-512:	9D6AF86BB481DBA1CCA27D1B1E033C1FF88E897E7E3A01F1EB375555F76804C6645AD35F135A67C8517DDE665E85E764F817481A1932761772F1249826CD1583
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.....&..........nE... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..............P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\sr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.483328555735341
Encrypted:	false
SSDEEP:	96:F5BUgrmJiYfHP+0xk5Ab/Y7lmjeKh84RyIaR1f0qylbJiCsYmRu3tcIGg81RbZGz:F5BUyYfveA8Ck9gKdoIwVy6
MD5:	86ACB497B738B450683E470AC526337C
SHA1:	12C815183D35249E31BDB2C700151149B262451F
SHA-256:	A08C08E4C0CDA7C86DF6305B772A4E43E2D3F41ACB5E070FA61B46D2207423E2
SHA-512:	07E3AF82D10B5683D09D9B57A50B43A25405CDA1D1051200AA43E675F4BA039FF6EE366A88AA98D84E09BEB2995A85D1638F7B11B88C8DD636BDB0262DDC5D5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.................;... ...@....... ....................................@.................................L;..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................;......H.......P7..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'*.m..it..t".\|...\| ..}

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\tr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.641037867562977
Encrypted:	false
SSDEEP:	96:rXgSDCrKnlhjHzO1Ao1mgzciYSUv4OKjOsDv4wA2yK7HRRm4ri0w+xj4tsB+uKUF:rFWry5O1AoAUL4h0jxKU5zBhywSCm6
MD5:	C77727FC0C4302F74469E5EAE4152452
SHA1:	6D227E4E2168432B85D711ACA7BC9F3F8E1F6066
SHA-256:	3EA569FEA7304A2B89156B32699A36C3B579B7CDE8298B1C938EDA40284FCAA2
SHA-512:	2688AEE13E8A207B02619A450C05A016F5AAC91816D65C129D35D2DFA3B6C31257BB882CAFBAA59A9D841A3F1A60C984F2BCA6920360C62513BFC018AC763E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...4.Cf...........!.....(...........F... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text...4&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H........A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\uk\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.842200970647284
Encrypted:	false
SSDEEP:	192:jTBUXUn/Djum3N6Vj4FmqgaxYCsrYhDqFp4FmWy6:P5LjumQVjwmqgaxYACpwmq
MD5:	951AC7C290127F2FC3E5A0854D862458
SHA1:	CC01CF4E8D9CD58C3310E9A704CC5E48385AB128
SHA-256:	0487C6C5BBFAB66329AC64FDCEB8C95AC6EB259ACB46348CFC39ADA758612A61
SHA-512:	62BBCB36DF694987EF5DF5D2E9011A8D4FB658A3CB3DC214CFF900C556CE4FCEEBBFB086E07FE495BE056556DEC797DF974532C55ED51C8ADB09EE3ACC85B672
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!....."..........NA... ...`....... ....................................@..................................@..W....`............................................................................... ............... ..H............text...T!... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B................0A......H........<..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....9.......PADPADPc....94.......T.P../..bq..a.Q...u.j....;..\......b...9...7..G....#............. x...n.(/\|..d....e.....k....}.O?......F. ...!.Q</..:3A..6..f8M.(DK..Gg..MO.6Q.N.S.i4X..]9Y.`.G<c.0.c...j\.}k.S.l.[.m'.m..it..t".\|...\| ..}

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\vi\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.954569059030031
Encrypted:	false
SSDEEP:	96:0gSDCrKntvIETAOAjlZuswNsHajkj4+dxuBdKycHo7R6TOd3CtpOe0i3B0Yk63lx:0FWryhArxcE3x3CYkDQ8DqPePrYSn6
MD5:	4795950D156A216F9313094FC7388A14
SHA1:	DFA30DB9ECAEAE2A468DB38255C7AA8A455E459D
SHA-256:	0545E1C0CB02B9A36E627F960EFFB6E9CFD1EBCBD699DE0469EACDCFDFF6EB13
SHA-512:	0F422B4B763E266F73A80BDD2C4F646A9F54F236156D68D357F8AF8C24B266DF5B47FFC3520AC83A36D1A0FF124D43BA4F61B019FEDBF2E072FDACE613BE5005
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!................I... ...`....... ....................................@..................................H..O....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................H......H........D..............P ..o$..........................................k$.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh-TW\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.185978321611355
Encrypted:	false
SSDEEP:	96:W9gSDCrKnsblHSWUT9WYfXOd8nzIjXDJ3OeOhZyKyhiHDRR1HkuXmFrPGVwPzbct:W9FWrldSWUwXklgSmrAY9pCrRlG6l
MD5:	7FE0EE444DFC4CA8F0E48E8797256355
SHA1:	9BF99EB702982AB9B70AFB9B1AD86D462FB9C97A
SHA-256:	428176371D2906B88F3EF32B0843C65076E51F05818423887ED6AB0F43DD8AF1
SHA-512:	21720C27C104FD611902C5A402569D118D68AECA2CE3D5FAAF2EAA38D1C07A9786D8C8B3D2270FCA6866BE3A0DA1C480B141D668A4A617E5A447C33EF3296F23
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!.....$...........C... ...`....... ....................................@..................................C..K....`............................................................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................C......H.......\|?..............P ..)...........................................%..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\zh\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.13805347376527
Encrypted:	false
SSDEEP:	96:NgSDCrKndIs4/hlGyaJ0Y1YoK7j+DJ0DDkJynKVKpR/P5DGQazTxkNvGLWtb7L2M:NFWrO4jMVQgzTKYIb+Lyi2+v6
MD5:	943EACAFABFE5B965265C3E63CD16D27
SHA1:	CD043D9BF851B39881B6A80489ADCA5E7E13E839
SHA-256:	8113B72FA0FE9EFD16134EB9945B02066D40B749722268D3133E6B56D3AF1968
SHA-512:	EC4F2287D83C98E13A8EEEF522E8143612656ED0ED79CA01989DBBCC53C8DD4C73FDD1524F7FE474F0F3F2DAE557E0A746511851E5388F7D696C16AD4CC62C91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5.Cf...........!.....$...........C... ...`....... ....................................@.................................8C..S....`............................................................................... ............... ..H............text....#... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................pC......H.......<?..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....M.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j.......;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d........e.....k....}.O?........F. ...!.z5$.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..M...PO.6Q

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.980720397663175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
File size:	116'256 bytes
MD5:	68b15abf143f5df8aad10eab1d2513d5
SHA1:	cb2566d06a85191582ab524d68f38d85556fb880
SHA256:	c1aaa8b374f0c43ae3d8817ac7731f1f71d2d04089e9c51510cddf38097dfb54
SHA512:	16d50a5e8ea66ce235614cfc51da3bfbe0cd9d2e2262954f0a15419c883d44121b432b6a84ab1c36ec1e4e5fcd364959b4960b7354339300e764697f7bb5c8ff
SSDEEP:	3072:L4GZnrASj3/XQLFvGwFCZ+XH+Im8wp7aO:L4GZrr3/A1B4p7aO
TLSH:	4CB3A04AFD4360F1E91BD970A68BFB3F8630E32784149DA7FFC64B05E9627B2640A105
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..c...............'..........................@..................................w....@... ............................

File Icon


Icon Hash:	0771d0d2250b3b8e

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6390A073 [Wed Dec 7 14:17:23 2022 UTC]
TLS Callbacks:	0x401780, 0x401730
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b26a7e001a4be269742be838dadc9db9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	13/01/2023 00:00:00 12/01/2026 23:59:59
Subject Chain	CN=Adguard Software Limited, O=Adguard Software Limited, S=Lefkosia, C=CY
Version:	3
Thumbprint MD5:	97CB1ECDC7F0BCBB54ACA397BB03E6D1
Thumbprint SHA-1:	48BAFFCE2694F647A33854183A4B817BB8A7DBEA
Thumbprint SHA-256:	453226C42EB62A278F091B0155200D76DD284A1337795B6EB37A627D414F1284
Serial:	00B138E6660DCA7CC377CB2F6F6027F616

Entrypoint Preview

Instruction
mov dword ptr [0041106Ch], 00000001h
jmp 00007F03A11EDC86h
nop
mov dword ptr [0041106Ch], 00000000h
jmp 00007F03A11EDC76h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F03A11F42BEh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 0040E000h
call dword ptr [004125F4h]
sub esp, 04h
test eax, eax
je 00007F03A11EE045h
mov ebx, eax
mov dword ptr [esp], 0040E000h
call dword ptr [00412658h]
mov edi, dword ptr [00412608h]
sub esp, 04h
mov dword ptr [00411028h], eax
mov dword ptr [esp+04h], 0040E013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 0040E029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [0040D004h], eax
sub esp, 08h
test esi, esi
je 00007F03A11EDFE3h
mov dword ptr [esp+04h], 0041102Ch
mov dword ptr [esp], 0040F104h
call esi
mov dword ptr [esp], 004015A0h
call 00007F03A11EDF33h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12000	0x1d0c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x8310	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19600	0x3020	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f000	0x7ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe488	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x124cc	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb0d4	0xb200	795976d8ade88f24cfb013314c16a55c	False	0.5650237008426966	data	6.245149254196926	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xd000	0x4a4	0x600	b13fe574645c82b1d74955ff3c177ab0	False	0.10416666666666667	data	1.0748674966658749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe000	0xbe0	0xc00	cdeb491c9f8ed943fbfa4e5a64126cdd	False	0.5481770833333334	data	5.322586268721286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0xf000	0x1fb0	0x2000	923ae17274e756093759304ab472082f	False	0.3533935546875	data	4.933913732859542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x11000	0xa74	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x12000	0x1d0c	0x1e00	7cf265bc970978cf36ffcbe8a9a610da	False	0.375	SysEx File -	5.372660458640531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x14000	0x34	0x200	4eef9a9546f6bf89752c594cebb6c33b	False	0.06640625	data	0.2601579489546485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x15000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x8310	0x8310	ae5b95a827ccff784c6821860ea20c07	False	0.8662672865999046	data	7.582095818588735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1f000	0x7ac	0x800	cd529a2d5f29be6c2efba8641354c9db	False	0.84619140625	data	6.519804353028213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x16208	0xf3c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0028205128205128
RT_RCDATA	0x17148	0x236f	PNG image data, 440 x 270, 8-bit/color RGBA, non-interlaced	English	United States	0.9622974313747106
RT_RCDATA	0x194b8	0x40e2	PNG image data, 880 x 540, 8-bit/color RGBA, non-interlaced	English	United States	0.9057796508127633
RT_RCDATA	0x1d5a0	0xe0	PNG image data, 7 x 10, 8-bit/color RGBA, non-interlaced	English	United States	1.0133928571428572
RT_RCDATA	0x1d680	0x149	PNG image data, 14 x 20, 8-bit/color RGBA, non-interlaced	English	United States	1.0212765957446808
RT_GROUP_ICON	0x1d7d0	0x14	data	English	United States	1.05
RT_VERSION	0x1d7e8	0x260	data	English	United States	0.4753289473684211
RT_MANIFEST	0x1da48	0x3dd	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4620829120323559

Imports

DLL	Import
COMCTL32.DLL	ImageList_Create
COMDLG32.DLL	GetOpenFileNameW, GetSaveFileNameW
GDI32.dll	CreateCompatibleDC, CreateFontIndirectW, CreateSolidBrush, DeleteDC, DeleteObject, GetDeviceCaps, GetStockObject, SelectObject, SetBkMode, SetTextColor
gdiplus.dll	GdipAlloc, GdipCloneBrush, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateFromHDC, GdipCreateHBITMAPFromBitmap, GdipCreateSolidFill, GdipDeleteBrush, GdipDeleteGraphics, GdipDisposeImage, GdipFillRectangleI, GdipFree, GdipGetImageHeight, GdipGetImageWidth, GdiplusShutdown, GdiplusStartup
KERNEL32.dll	CancelWaitableTimer, CloseHandle, ConnectNamedPipe, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateHardLinkW, CreateIoCompletionPort, CreateNamedPipeW, CreateProcessW, CreateThread, CreateWaitableTimerW, DeleteCriticalSection, DeleteFileW, DisconnectNamedPipe, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FindResourceW, FormatMessageW, FreeLibrary, GetCommandLineW, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDiskFreeSpaceW, GetExitCodeProcess, GetExitCodeThread, GetFileAttributesExW, GetFileSizeEx, GetLastError, GetLocaleInfoW, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetNativeSystemInfo, GetNumberOfConsoleInputEvents, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetQueuedCompletionStatus, GetStartupInfoA, GetSystemTimeAsFileTime, GetThreadTimes, GlobalAddAtomA, GlobalAlloc, GlobalDeleteAtom, GlobalFree, GlobalLock, GlobalUnlock, HeapAlloc, HeapFree, HeapReAlloc, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadResource, LockResource, MapViewOfFile, MoveFileExW, MultiByteToWideChar, PostQueuedCompletionStatus, QueryPerformanceFrequency, ReadConsoleInputW, ReadFile, RemoveDirectoryW, SetConsoleCtrlHandler, SetConsoleMode, SetDllDirectoryW, SetEndOfFile, SetEvent, SetFileAttributesW, SetFilePointerEx, SetLastError, SetUnhandledExceptionFilter, SetWaitableTimer, SizeofResource, Sleep, SwitchToThread, TlsGetValue, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile
MSIMG32.DLL	AlphaBlend
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _daylight, _errno, _initterm, _iob, _onexit, _stricmp, _timezone, _tzset, _wcsicmp, abort, atoi, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, memchr, memcpy, memset, qsort, setlocale, signal, strchr, strerror, strlen, strncmp, vfprintf, wcslen
ole32.dll	CreateStreamOnHGlobal
SHELL32.dll	DragFinish, DragQueryFileW, ExtractIconExW, ILCreateFromPathW, ILFree, SHOpenFolderAndSelectItems, ShellExecuteW, Shell_NotifyIconW
USER32.dll	CallWindowProcW, CloseClipboard, CreateAcceleratorTableW, CreateWindowExW, DefWindowProcW, DestroyAcceleratorTable, DestroyWindow, DispatchMessageW, EmptyClipboard, FillRect, GetClientRect, GetCursorPos, GetDC, GetFocus, GetMessageW, GetParent, GetWindowLongW, GetWindowPlacement, GetWindowRect, IsWindowVisible, LoadCursorW, LoadIconW, LoadImageW, MessageBoxW, OpenClipboard, PostMessageW, PostQuitMessage, PostThreadMessageW, RegisterClassExW, RegisterHotKey, ReleaseDC, ScreenToClient, SendMessageTimeoutW, SendMessageW, SetClipboardData, SetCursor, SetFocus, SetForegroundWindow, SetLayeredWindowAttributes, SetWindowLongW, SetWindowPlacement, SetWindowPos, ShowWindow, SystemParametersInfoW, TrackPopupMenuEx, TranslateAcceleratorW, TranslateMessage, UnregisterClassW, UnregisterHotKey, UpdateLayeredWindow
WININET.DLL	HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlW, InternetOpenW, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
06/22/24-06:27:57.276819	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49734	80	192.168.2.4	156.146.33.140

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2024 06:27:57.270756960 CEST	49734	80	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.276592016 CEST	80	49734	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:57.276670933 CEST	49734	80	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.276818991 CEST	49734	80	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.282999039 CEST	80	49734	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:57.906656981 CEST	80	49734	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:57.906754017 CEST	49734	80	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.915832043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.915874004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:57.915965080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.928317070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:57.928343058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:58.577997923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:58.578216076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:58.810837030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:58.810866117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:58.811222076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:58.811358929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:58.982063055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.028512955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.190360069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.190383911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.190398932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.190439939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.190469980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.190483093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.190530062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.286079884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.286098003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.286151886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.286170006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.286195040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.286211014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.319341898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.319361925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.319439888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.319453001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.319497108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.358946085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.358966112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.359039068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.359055042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.359098911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.390811920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.390831947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.390947104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.390964031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.391020060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.414690971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.414709091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.414800882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.414812088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.414855957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.439079046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.439095020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.439208031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.439224005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.439275026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.457262039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.457277060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.457360983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.457375050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.457418919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.470637083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.470652103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.470705032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.470716953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.470736027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.470757008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.483957052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.483972073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.484025002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.484036922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.484075069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.494796038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.494810104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.494865894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.494877100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.494908094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.507404089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.507416964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.507462025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.507472038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.507498026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.507514954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.519438028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.519453049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.519509077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.519520998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.519555092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.529160023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.529174089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.529230118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.529239893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.529274940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.540240049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.540256023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.540309906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.540322065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.540353060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.549191952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.549207926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.549293041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.549309969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.549345016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.559243917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.559261084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.559309959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.559319019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.559345961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.559385061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.568278074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.568294048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.568370104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.568378925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.568418026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.579296112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.579312086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.579374075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.579382896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.579418898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.590135098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.590148926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.590187073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.590197086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.590215921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.590239048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.602247953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.602262020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.602323055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.602338076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.602377892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.612426043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.612443924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.612570047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.612581015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.612617016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.623697996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.623713970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.623796940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.623809099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.623845100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.644746065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.644762039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.644861937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.644898891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.644943953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.646661043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.646677017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.646729946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.646739006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.646773100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.646794081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.652395010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.652412891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.652512074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.652520895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.652558088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.671931028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.671947002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.672003984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.672012091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.672049046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.684596062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.684609890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.684686899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.684695959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.684735060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.696633101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.696646929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.696708918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.696721077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.696763992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.706259966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.706276894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.706360102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.706370115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.706409931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.717391014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.717405081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.717457056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.717467070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.717482090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.717509985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.733364105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.733378887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.733453989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.733463049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.733495951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.736568928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.736582994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.736641884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.736650944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.736685038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.745454073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.745469093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.745528936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.745537996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.745574951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.760560989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.760575056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.760659933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.760668993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.760709047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.773324966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.773339987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.773397923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.773411989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.773452044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.785099983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.785115004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.785181999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.785197973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.785212040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.785234928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.794816017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.794831038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.794894934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.794912100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.794951916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.806072950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.806091070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.806142092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.806150913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.806165934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.806190014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.822141886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.822154999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.822220087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.822228909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.822268963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.825016975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.825031996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.825086117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.825093985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.825134039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.833940029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.833956003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.834024906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.834039927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.834075928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.849880934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.849898100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.849965096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.849975109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.850013018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.861829042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.861844063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.861896992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.861907959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.861923933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.861949921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.873642921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.873662949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.873739958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.873753071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.873796940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.883497953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.883513927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.883574963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.883586884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.883624077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.894568920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.894583941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.894646883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.894656897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.894697905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.910804033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.910820007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.910864115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.910873890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.910904884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.910917997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.913662910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.913681030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.913722038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.913729906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.913763046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.913779974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.922595978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.922622919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.922661066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.922671080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.922696114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.922715902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.988559008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.988580942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.988634109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.988646984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:27:59.988662004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:27:59.988677979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.037421942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.037441015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.037548065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.037575006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.037614107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.076916933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.076937914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.077091932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.077100992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.077203989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.080347061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.080363035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.080498934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.080507040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.080634117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.084557056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.084570885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.084645987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.084655046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.084696054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.105160952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.105178118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.105293989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.105305910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.105390072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.106297016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.106312037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.106478930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.106488943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.106529951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.109885931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.109900951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.109986067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.110001087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.110205889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.115108013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.115123034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.115287066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.115299940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.115369081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.126027107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.126071930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.126179934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.126195908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.126240969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.166080952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.166096926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.166219950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.166234970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.166290998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.172713995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.172729015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.172877073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.172884941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.172952890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.174815893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.174832106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.174910069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.174917936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.174959898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.196331978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.196346998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.196441889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.196454048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.196501970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.196501970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.196693897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.196707964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.196758986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.196767092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.196815968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.198519945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.198534012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.198653936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.198662996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.198740005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.203547001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.203562975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.203732967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.203742027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.203809023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.214689970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.214705944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.214823961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.214823961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.214833975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.214936972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.254720926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.254740000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.254848003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.254865885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.254916906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.261389017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.261404037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.261482000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.261492014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.261617899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.263349056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.263364077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.263454914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.263463020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.263494968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.284990072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.285037041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.285092115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.285100937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.285156965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.285156965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.285775900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.285818100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.285917997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.285917997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.285926104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.285972118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.287271023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.287313938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.287379980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.287379980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.287389040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.287424088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.292380095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.292429924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.292485952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.292495012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.292510033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.292525053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.303419113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.303463936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.303505898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.303513050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.303545952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.343730927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.343782902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.343885899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.343909025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.343977928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.343977928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.350076914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.350122929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.350328922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.350337982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.350474119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.352109909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.352152109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.352197886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.352205038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.352396011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.352396011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.373624086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.373666048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.373766899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.373766899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.373801947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.373864889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.374377012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.374418020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.374483109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.374483109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.374490976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.374603987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.375710011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.375754118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.375816107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.375816107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.375823021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.375917912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.380991936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.381037951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.381099939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.381099939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.381109953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.381150007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.392193079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.392235041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.392298937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.392313957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.392334938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.392380953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.432416916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.432460070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.432660103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.432668924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.432724953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.438791037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.438832045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.438885927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.438894033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.438941956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.438941956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.440649986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.440706968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.440751076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.440757990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.440808058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.440808058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.462389946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.462433100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.462506056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.462506056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.462517023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.462560892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.463133097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.463174105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.463207006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.463221073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.463285923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.463285923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.464375019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.464421988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.464499950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.464499950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.464509964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.464554071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.469743967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.469784975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.469831944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.469840050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.469856977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.469883919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.480860949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.480907917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.480981112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.480989933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.481014967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.481120110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.521099091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.521142006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.521188021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.521200895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.521230936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.521315098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.527345896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.527390003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.527479887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.527479887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.527488947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.527540922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.529402971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.529445887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.529479027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.529485941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.529582024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.529582024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.551244974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.551302910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.551384926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.551384926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.551393986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.551471949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.551538944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.551580906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.551660061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.551667929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.551692963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.551733971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.552865028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.552880049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.552942991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.552951097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.552998066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.558296919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.558314085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.558471918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.558479071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.558532953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.569365978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.569381952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.569452047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.569459915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.569529057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.609659910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.609678030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.609765053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.609765053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.609774113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.609842062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.615825891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.615845919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.616070032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.616079092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.616233110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.617912054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.617928028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.618010998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.618017912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.618055105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.639679909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.639695883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.639782906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.639796019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.639985085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.640228033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.640244007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.640311003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.640317917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.640381098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.643373013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.643389940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.643495083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.643501043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.643548012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.646965027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.646981955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.647094011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.647104979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.647196054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.657968998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.657984018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.658149004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.658157110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.658299923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.698189020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.698205948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.698398113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.698410034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.698498964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.704634905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.704651117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.704762936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.704771996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.704837084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.707001925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.707016945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.707055092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.707062006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.707158089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.707158089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.728250027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.728266001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.728507996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.728517056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.728614092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.728899002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.728915930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.729012012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.729018927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.729062080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.731910944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.731925964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.732038021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.732045889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.732109070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.735541105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.735560894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.735626936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.735634089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.735673904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.746543884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.746561050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.746717930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.746726990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.746830940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.786875963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.786891937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.787002087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.787010908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.787075996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.793216944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.793234110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.793287039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.793294907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.793375015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.795492887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.795507908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.795579910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.795588017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.795634985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.817048073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.817066908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.817200899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.817210913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.817275047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.817780972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.817810059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.817893028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.817900896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.818048000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.820615053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.820628881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.820743084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.820750952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.820795059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.824678898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.824692011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.824773073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.824781895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.824873924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.837757111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.837774038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.837857008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.837867975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.837901115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.875636101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.875654936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.875794888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.875806093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.875874996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.881798983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.881819963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.881892920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.881901026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.881947994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.884067059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.884082079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.884192944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.884200096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.884254932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.905622005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.905638933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.905733109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.905740023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.905802965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.906260967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.906275034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.906341076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.906347036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.906382084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.909264088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.909279108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.909389019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.909399033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.909434080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.913196087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.913209915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.913427114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.913435936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.913477898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.923768044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.923784018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.923938036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.923945904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.924055099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.964399099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.964416027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.964500904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.964509010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.964557886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.970582008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.970599890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.970720053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.970729113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.970791101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.972764015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.972783089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.972886086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.972893953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.972955942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.994235039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.994250059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.994374037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.994385958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.994452000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.995002985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.995018005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.995091915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.995099068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.995176077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.997996092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.998013973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.998085022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:00.998094082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:00.998194933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.002230883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.002249002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.002316952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.002324104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.002402067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.012470961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.012506962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.012561083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.012572050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.012588978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.012650967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.053291082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.053308964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.053422928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.053431988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.053515911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.059134960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.059150934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.059253931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.059262991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.059346914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.061336040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.061352015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.061444044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.061451912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.061552048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.083172083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.083188057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.083261013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.083267927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.083342075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.083705902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.083719969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.083791971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.083792925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.083801985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.083873034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.087821960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.087841988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.087924004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.087932110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.087987900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.090979099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.090995073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.091084003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.091092110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.091280937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.102494955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.102514982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.102587938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.102596045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.102725983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.141910076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.141937017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.142018080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.142018080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.142030001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.142069101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.147998095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.148016930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.148104906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.148113966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.148161888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.150316000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.150331974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.150425911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.150437117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.150485992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.171792030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.171813011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.171854019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.171871901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.171952009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.171952009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.172363997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.172379017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.172424078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.172435999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.172476053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.172504902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.176407099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.176423073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.176502943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.176513910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.176623106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.179794073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.179806948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.179860115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.179876089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.179919958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.179919958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.191274881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.191291094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.191334009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.191351891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.191407919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.191407919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.230561018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.230576038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.230671883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.230683088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.230782032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.236572981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.236587048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.236661911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.236671925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.236803055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.239016056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.239049911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.239115953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.239115953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.239123106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.239222050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.260437965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.260452986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.260536909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.260545969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.260612011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.260973930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.260987997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.261117935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.261125088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.261185884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.265201092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.265216112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.265327930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.265340090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.265392065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.268522024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.268536091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.268723011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.268731117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.268810034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.280000925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.280015945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.280083895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.280092001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.280138016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.320666075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.320686102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.320805073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.320813894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.320890903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.320890903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.325205088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.325218916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.325313091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.325321913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.325361013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.327769041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.327784061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.327934980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.327944040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.328020096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.349034071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.349049091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.349153042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.349165916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.349208117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.349956989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.349971056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.350075006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.350083113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.350138903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.355467081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.355482101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.355600119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.355600119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.355611086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.355663061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.358503103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.358517885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.358696938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.358705997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.358762980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.368988037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.369004965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.369198084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.369205952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.369246960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.409060955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.409080029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.409369946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.409379005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.409573078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.661933899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.661958933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.662206888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.662229061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.662244081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.662265062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.662313938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.662313938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.662322998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.662369967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.664633036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.664648056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.664710045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.664716959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.664760113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665091991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665108919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665152073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665158987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665195942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665195942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665432930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665448904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665509939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665515900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665529013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665599108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665816069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665832043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665882111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.665889978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.665962934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.666119099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.666146040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.666203022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.666209936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.666240931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.666274071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.666836023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.666851997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.666928053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.666935921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.667016029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.667076111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.667093039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.667196035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.667201996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.667243958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.667841911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.667857885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.667943001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.667949915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.668011904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.668112993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.668128014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.668268919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.668268919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.668277025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.668312073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.669051886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.669069052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.669130087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.669137955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.669182062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.669744015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.669759035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.669794083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.669802904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.669830084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.669876099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.670645952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.670660973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.670718908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.670726061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.670823097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.670823097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.671031952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.671049118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.671122074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.671122074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.671129942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.671163082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.671756983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.671775103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.671865940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.671865940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.671873093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.671937943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.672349930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.672368050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.672472954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.672487974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.672533035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673053980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673070908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673125029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673132896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673154116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673193932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673559904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673577070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673643112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673643112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673649073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673722982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673741102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673752069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673758030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.673774958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.673922062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.674603939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.674618959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.674732924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.674740076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.674814939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.675407887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.675424099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.675457001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.675463915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.675499916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.675499916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.676703930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.749033928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.749053955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.749187946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.749197006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.749283075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.750164986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750180006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750222921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.750228882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750272036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.750586033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750602007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750706911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.750714064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750746965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.750890970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.750907898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751022100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.751028061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751082897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.751209021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751225948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751291037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.751298904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751363039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.751637936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751653910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751714945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.751714945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.751723051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.751782894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.753927946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.753943920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.754180908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.754228115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.754236937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.754262924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.754307985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.776702881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.837569952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.837591887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.837723970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.837734938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.837816954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.838336945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.838352919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.838407993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.838417053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.838524103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.842751026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.842780113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.842844009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.842856884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.842906952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.842906952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843056917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843074083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843143940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843151093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843190908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843420029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843436003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843538046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843544960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843586922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843626022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843635082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843710899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843710899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843867064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843887091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843921900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843930960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.843992949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.843992949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.844273090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.844290018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.844367027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.844383955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.844418049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.926197052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.926218987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.926403999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.926419973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.926472902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.926824093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.926840067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.926940918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.926949978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.927010059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.931524038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.931539059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.931628942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.931636095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.931684017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.931835890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.931850910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.931884050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.931890965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.931930065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.931930065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932149887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932166100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932240963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932246923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932305098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932410002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932425022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932512045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932518959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932574034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932739019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932754040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932847023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932847023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.932852983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.932884932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.933023930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.933044910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.933119059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.933120012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:01.933128119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:01.933167934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.015290976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.015307903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.015397072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.015404940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.015450001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.017111063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.017126083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.017198086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.017205954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.017256021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.020925999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.020941973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021034002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021034002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021042109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021142006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021178007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021193027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021225929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021233082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021348953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021348953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021492958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021507978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021547079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021553040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021591902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021630049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021769047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021785021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021832943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.021838903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.021869898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.022641897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.022658110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.022725105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.022725105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.022732973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.022804022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.022926092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.022943020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.022974968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.022980928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.023011923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.023072004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.103902102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.103923082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.104212046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.104224920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.104300022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.104660988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.104677916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.104724884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.104732990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.104748964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.104773998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.109323025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109350920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109477997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.109477997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.109484911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109523058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109549046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.109555006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109576941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.109637976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.109865904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109880924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.109996080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110002041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110021114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110038996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110064983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110064983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110071898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110090971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110136032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110264063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110282898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110343933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110343933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110352039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110387087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110863924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110879898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.110977888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.110985041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.111025095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.192583084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.192603111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.192684889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.192699909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.192789078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.193280935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.193295956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.193332911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.193340063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.193366051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.193409920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.197981119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.197998047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198071957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198079109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198115110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198276043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198292017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198402882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198410034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198509932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198606014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198621988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198666096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198673010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198705912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198905945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198920965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.198997974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.198997974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.199006081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.199037075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.200392008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.200407982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.200510025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.200519085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.200532913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.200578928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.200588942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.200593948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.200639009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.283417940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.283447027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.283483028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.283490896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.283524990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.283562899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.284616947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.284632921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.284691095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.284698963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.284739971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.289489985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.289505005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.289583921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.289591074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.289623022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.289855003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.289870024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.289916039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.289925098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.289977074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.290272951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.290287971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.290473938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.290478945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.290585041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.290600061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.290611029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.290622950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.290637016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.290703058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.290999889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.291021109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.291075945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.291081905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.291090965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.291134119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.291275024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.291289091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.291313887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.291321039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.291363001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.291363001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.372503042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.372545958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.372685909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.372701883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.372725964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.372819901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.373344898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.373368979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.373435020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.373442888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.373450994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.373473883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378206968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378226042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378334045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378357887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378411055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378446102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378459930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378514051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378520966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378582954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378730059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378747940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378789902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378794909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.378829956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.378830910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379010916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379045010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379070997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379077911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379115105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379115105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379334927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379349947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379383087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379390955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379410028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379441023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379558086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379571915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379673958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.379682064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.379719973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.461234093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.461261034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.461334944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.461344004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.461395979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.461395979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.461816072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.461833954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.461884022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.461889982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.461908102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.462064981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.466737986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.466758966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.466830969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.466840029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.466886997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467092991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467112064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467168093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467174053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467211962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467442036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467467070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467536926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467536926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467542887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467582941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467700958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467717886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467778921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467778921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.467784882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.467839956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.468058109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.468077898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.468158960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.468164921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.468224049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.468250036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.468255997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.468285084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.468437910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.549832106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.549854994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.549966097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.549993038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.550041914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.550398111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.550429106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.550458908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.550465107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.550502062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.550502062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.555470943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.555493116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.555581093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.555588007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.555687904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.555790901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.555808067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.555845976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.555851936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.555880070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.555886984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.556049109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556066036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556108952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.556113958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556205988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.556334972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556350946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556494951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.556503057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556549072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.556668997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556688070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556751013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.556756973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.556802034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.557075977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.557090998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.557142973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.557142973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.557149887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.557261944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.638542891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.638566971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.638706923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.638722897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.638864994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.639097929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.639120102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.639281034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.639281034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.639287949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.639380932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644088984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644110918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644167900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644174099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644217968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644459963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644493103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644525051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644532919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644579887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644579887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644717932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644735098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644773960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644781113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.644808054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.644829988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.645047903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645066023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645140886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.645148039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645203114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.645334959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645350933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645411968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.645418882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645479918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.645628929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645644903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645715952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.645723104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.645903111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.729181051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.729208946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.729399920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.729415894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.729439020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.729471922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.729536057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.732796907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.732822895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.732876062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.732884884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.732901096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.732929945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.733458996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.733481884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.733565092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.733565092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.733572006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.733599901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.733616114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.733628035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.733647108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.733665943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.733784914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.734011889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.734055996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.734091043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.734096050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.734122992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.734136105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.735367060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.735390902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.735456944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.735461950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.735469103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.735507011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.735512972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.735677958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.818169117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.818195105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.818284035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.818284035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.818296909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.818363905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.818501949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.818516016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.818558931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.818568945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.818703890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.822918892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.822952986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.823016882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.823016882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.823026896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.823070049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.823702097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.823721886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.823786974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.823795080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.823829889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.823831081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.824296951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.824315071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.824383020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.824397087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.824410915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.824436903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.824470997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.827038050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.827055931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.827124119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.827132940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.827227116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.827445030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.827464104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.827524900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.827532053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.827634096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.907260895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.907280922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.907407999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.907427073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.907500982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.907525063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.907537937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.907552958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.907603025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.911351919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.911372900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.911438942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.911448956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.911521912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.912281990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912297964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912352085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.912360907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912427902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.912698030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912712097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912784100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.912791014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912822962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.912951946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.912966013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.913022995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.913029909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.913110018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.915713072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.915726900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.915811062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.915817976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.915875912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.916064978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.916079998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.916275024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.916281939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.916358948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.998440981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.998456955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.998583078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.998594046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.998632908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.999648094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.999665022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.999725103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:02.999733925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:02.999809027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.001734972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.001750946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.001857042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.001863956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.001959085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.003818989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.003834009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.003935099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.003941059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.004000902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.004040956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.004057884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.004089117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.004096031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.004152060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.004951000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.004966974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.005091906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.005100012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.005156994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.008203030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.008219004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.008351088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.008357048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.008424997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.008632898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.008649111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.008704901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.008712053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.008763075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.086483002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.086508036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.086596012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.086596966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.086608887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.086652040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.087059975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.087075949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.087142944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.087151051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.087189913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.089673042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.089689970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.089864969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.089873075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.089909077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.091140985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.091156960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.091238976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.091247082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.091279984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.092803955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.092818975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.092876911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.092884064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.092952013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.093110085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.093126059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.093170881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.093188047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.093247890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.095900059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.095913887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.095995903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.096004009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.096041918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.096139908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.096155882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.096218109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.096225023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.096261978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.175321102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.175348997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.175425053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.175436974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.175446033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.175474882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.175590038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.175606012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.175653934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.175662041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.175678015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.175801992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.178618908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.178634882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.178694010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.178699970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.178710938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.178728104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.179883003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.179898024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.179999113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.180006027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.180048943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.181476116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.181489944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.181552887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.181577921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.181617022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.181803942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.181818008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.181875944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.181890011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.181927919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.184362888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.184380054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.184458017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.184464931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.184521914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.184916019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.184933901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.185023069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.185029984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.185071945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.263868093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.263887882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.263998985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.264009953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.264224052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.264225960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.264236927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.264266014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.264291048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.264295101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.264314890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.264501095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.267360926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.267374039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.267457962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.267467022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.267505884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.268522978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.268537045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.268627882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.268635988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.268675089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.270056963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.270071030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.270117998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.270123959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.270139933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.270164967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.270615101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.270629883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.270682096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.270689011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.270721912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.273171902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.273185968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.273233891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.273241997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.273257971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.273303032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.273592949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.273611069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.273669958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.273678064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.273720980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.353144884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.353167057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.353286982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.353297949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.353365898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.353594065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.353609085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.353718996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.353725910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.353763103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.356117964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.356132030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.356262922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.356270075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.356319904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.357472897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.357486963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.357564926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.357573032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.357625008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.358829021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.358850002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.358918905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.358927011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.358966112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.359070063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.359083891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.359122038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.359127998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.359148979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.359164953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.365431070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.365446091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.365545988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.365559101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.365595102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.365854979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.365869999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.365926027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.365932941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.365955114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.365972996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.441881895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.441901922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.441967010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.441982031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.442002058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.442037106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.442274094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.442290068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.442336082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.442343950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.442379951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.445754051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.445770979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.445813894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.445821047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.445863962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.445863962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.446440935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.446458101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.446528912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.446530104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.446537971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.446571112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.447720051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.447735071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.447880030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.447887897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.447927952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.448129892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.448146105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.448184013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.448191881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.448219061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.448249102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.454194069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454210997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454333067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.454340935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454498053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.454504013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454516888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454533100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454550982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.454557896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.454602003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.454602003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.532366991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.532408953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.532465935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.532474995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.532499075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.532530069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.533322096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.533344030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.533406019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.533413887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.533428907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.533449888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.538289070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.538311958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.538353920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.538366079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.538383007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.538453102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.538613081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.538635015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.538676023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.538681984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.538708925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.538881063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.540132046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.540153027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.540225029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.540225983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.540231943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.540266037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.540617943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.540640116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.540771008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.540777922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.540817976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.543936968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.543957949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.544045925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.544045925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.544051886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.544087887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.544111013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.544131994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.544157028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.544163942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.544207096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.544207096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.621062994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.621084929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.621315956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.621336937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.621377945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.621992111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.622009039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.622137070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.622144938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.622181892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.627262115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.627278090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.627351046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.627357960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.627393961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.627487898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.627502918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.627545118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.627552032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.627574921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.627619982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.628773928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.628788948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.628842115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.628849983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.628887892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.629262924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.629281044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.629646063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.629652977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.629694939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.632658958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.632673025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.632721901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.632728100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.632765055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.632946014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.632960081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.633057117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.633064032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.633111000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.710738897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.710757017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.711066008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.711083889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.711142063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.711183071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.711198092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.711251020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.711268902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.711325884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.715801954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.715816021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.715873003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.715882063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.715954065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.716057062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.716072083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.716192007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.716197968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.716243029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.717386007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.717401028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.717492104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.717502117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.717619896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.717794895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.717808962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.717875957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.717881918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.717925072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.721318960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.721333027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.721404076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.721411943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.721451044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.721790075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.721802950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.721879959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.721887112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.721925020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.799679995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.799698114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.799807072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.799818993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.799844027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.799873114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.799967051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.799967051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.799967051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.799973965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.800015926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.804805994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.804821968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.804893970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.804900885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.804941893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.805005074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.805021048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.805097103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.805104971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.805161953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.805875063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.805895090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.805973053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.805984974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.806024075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.806556940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.806574106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.806628942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.806636095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.806674957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.810054064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.810069084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.810153961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.810163021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.810311079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.810409069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.810434103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.810467958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.810476065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.810488939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.810537100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.890089989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.890106916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.890301943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.890342951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.890455008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.890455008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.890460968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.890508890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.893374920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.893388987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.893476009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.893484116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.893522978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.893631935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.893647909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.893707037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.893714905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.893918991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.894696951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.894711018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.894757032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.894763947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.894804955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.894804955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.895131111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.895145893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.895292997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.895298958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.895385981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.898899078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.898914099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.899054050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.899063110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.899106026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.899420977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.899435043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.899630070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.899636984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.899709940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.978691101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.978709936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.978888035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.978918076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.978929043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.978955984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.979015112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.982177019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.982191086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.982266903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.982274055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.982306004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.982825041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.982844114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.982923985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.982932091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.982969999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.983160019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.983180046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.983233929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.983239889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.983259916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.983287096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.983767986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.983782053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.983894110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.983901978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.983944893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.988167048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.988182068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.988287926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.988295078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.988326073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.988338947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.988346100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.988359928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:03.988374949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:03.988449097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.067260027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.067276001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.067348957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.067348957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.067357063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.067392111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.069288015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.069353104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.069360971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.069382906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.069406033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.069427967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.071046114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.071105003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.071127892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.071183920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.071845055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.071891069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.071923018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.071927071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.071942091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.071962118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.072231054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.072273016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.072295904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.072300911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.072324038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.072343111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.072554111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.072596073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.072612047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.072618961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.072648048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.072664022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.076879978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.076937914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.076958895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.076966047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.076993942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.077033043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.077133894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.077179909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.077198029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.077204943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.077230930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.077249050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.155935049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.155971050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.156008959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.156022072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.156040907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.156060934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.157582998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.157609940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.157644987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.157649994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.157679081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.157696962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.159629107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.159657955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.159698963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.159703970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.159733057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.159751892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.160187006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.160208941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.160245895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.160249949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.160278082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.160294056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.160722017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.160744905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.160793066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.160798073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.160825968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.161492109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.161518097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.161551952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.161556959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.161582947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.161600113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.165271044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.165294886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.165334940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.165339947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.165374994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.165627956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.165647984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.165673971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.165678024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.165697098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.165716887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.244811058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.244875908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.245018005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.245018005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.245035887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.245075941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.246473074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.246515036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.246545076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.246550083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.246572018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.246592999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.248630047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.248676062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.248706102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.248711109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.248752117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.249244928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.249293089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.249320030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.249325037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.249341011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.249365091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.250155926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.250197887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.250225067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.250230074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.250255108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.250276089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.250341892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.250384092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.250399113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.250406027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.250436068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.250452042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.254755974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.254798889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.254829884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.254833937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.254863024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.254882097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.254956007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.255000114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.255016088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.255022049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.255050898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.255064011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.333518982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.333571911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.333746910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.333746910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.333758116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.333795071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.335216999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.335273027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.335299969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.335304976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.335330009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.335350990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.337173939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.337219000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.337249994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.337255001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.337285995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.337310076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338274002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338320017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338351011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338356018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338386059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338402987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338478088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338521004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338538885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338545084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338576078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338587999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338862896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338902950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338947058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338951111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.338970900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.338994980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.343193054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.343252897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.343277931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.343283892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.343318939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.343337059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.343470097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.343511105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.343528032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.343534946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.343561888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.343579054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.422144890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.422194958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.422247887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.422256947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.422306061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.424133062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.424173117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.424216032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.424221992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.424243927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.424271107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.425765038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.425810099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.425854921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.425859928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.425899982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.426712036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.426776886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.426863909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.426925898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.427047014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.427086115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.427104950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.427110910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.427145958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.427158117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.427555084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.427594900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.427619934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.427624941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.427649975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.427669048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.432092905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.432137966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.432188988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.432193995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.432239056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.432389975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.432432890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.432462931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.432467937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.432496071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.432502031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.514653921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.514736891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.514784098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.514802933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.514832973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.514851093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.514952898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.515012026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.515032053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.515084028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.518718004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.518760920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.518789053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.518795967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.518817902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.518834114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519093037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519133091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519155979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519160986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519193888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519687891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519726992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519756079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519761086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519781113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519795895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519823074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519867897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519879103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519896030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.519916058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.519932985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.523531914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.523576975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.523602009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.523607016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.523638010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.523813009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.523855925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.523880005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.523885012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.523900986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.523917913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.599689960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.599747896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.599832058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.599858046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.599885941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.599905968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.602648020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.602691889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.602720976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.602731943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.602766037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.602778912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607078075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607126951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607165098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607172966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607208967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607222080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607328892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607372999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607388973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607397079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607420921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607435942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607666016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607709885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607727051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607734919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.607762098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.607774019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.608679056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.608736992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.608750105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.608767986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.608791113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.608809948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.612287998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.612329960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.612354994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.612360001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.612387896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.612406015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.612459898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.612524033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.612549067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.612602949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.688592911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.688642979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.688787937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.688787937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.688802004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.688839912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.691250086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.691293955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.691323042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.691328049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.691368103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.695746899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.695794106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.695826054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.695832014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.695863962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.695878983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.696082115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.696126938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.696142912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.696149111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.696175098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.696193933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.696281910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.696326017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.696341991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.696347952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.696374893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.696393013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.697077036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.697124004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.697144032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.697149992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.697175026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.697195053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.700633049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.700675011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.700706959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.700715065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.700757027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.701023102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.701065063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.701083899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.701088905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.701126099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.780352116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.780405045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.780581951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.780581951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.780592918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.780632973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.780723095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.780765057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.780778885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.780785084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.780812979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.780831099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.784701109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.784743071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.784773111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.784778118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.784822941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.784893036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.784936905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.784954071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.784960032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.784987926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.785003901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.785347939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.785413980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.785430908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.785486937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.785797119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.785839081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.785851002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.785856009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.785890102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.789477110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.789535046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.789546967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.789562941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.789582968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.789602041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.789793968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.789854050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.789855003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.789877892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.789904118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.789918900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.868979931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.869046926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.869174957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.869174957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.869184971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.869220972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.869251013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.869291067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.869304895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.869311094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.869338989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.869357109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.877351999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.877397060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.877435923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.877443075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.877485991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.878077984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.878134966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.878155947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.878207922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.879245996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.879292011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.879308939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.879314899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.879344940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.879363060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.881690979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.881733894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.881762028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.881767035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.881798029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.881814957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.887898922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.887938976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.887969017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.887974024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.888021946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.888406038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.888447046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.888463020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.888468981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.888492107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.888514996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957684994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957732916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957778931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957792044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957818985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957839012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957845926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957865953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957892895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957901001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957921982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957926035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.957947969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.957976103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.966690063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.966730118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.966779947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.966790915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.966814995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.966836929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.967083931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.967116117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.967140913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.967144966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.967171907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.967190027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.968055010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.968087912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.968115091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.968118906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.968154907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.970276117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.970325947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.970351934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.970356941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.970371962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.970396042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.976579905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.976644039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.976648092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.976666927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.976692915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.976716042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.976794004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.976819038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.976844072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.976847887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:04.976883888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:04.976890087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.046094894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.046138048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.046166897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.046175003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.046195984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.046217918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.046519995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.046546936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.046574116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.046580076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.046596050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.046613932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.055306911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.055337906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.055380106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.055387974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.055402994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.055424929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.055977106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.055996895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.056029081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.056035042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.056051016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.056071043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.056432962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.056452990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.056479931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.056489944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.056509972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.056531906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.058886051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.058912039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.058937073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.058940887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.058974028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.058985949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.065073967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.065104008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.065129995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.065135002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.065155983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.065167904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.065509081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.065543890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.065562010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.065566063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.065583944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.065603971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.136331081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.136369944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.136466980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.136502028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.136539936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.144362926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.144396067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.144498110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.144510031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.144552946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.147387028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.147406101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.147464991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.147465944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.147480965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.147505045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.147510052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.147550106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.147555113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.147594929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.148683071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.148706913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.148739100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.148745060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.148773909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.148793936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.153656960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.153709888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.153739929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.153747082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.153794050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.157881975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.157917023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.157942057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.157947063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.157985926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.157998085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.158204079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.158235073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.158260107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.158263922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.158284903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.158303976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.223968983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.224008083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.224041939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.224052906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.224075079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.224097013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.225076914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.225111008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.225147963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.225153923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.225215912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.234886885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.234924078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.234951019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.234958887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.234999895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.234999895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.236057043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.236092091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.236119032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.236123085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.236146927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.236183882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.237200975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.237234116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.237265110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.237270117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.237298965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.237313032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.242491007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.242528915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.242562056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.242567062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.242589951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.242608070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.246030092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.246058941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.246100903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.246105909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.246284962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.246284962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.246445894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.246468067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.246501923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.246507883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.246532917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.246552944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.319885015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.319931030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.320071936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.320086956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.320105076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.320126057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.320338964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.327970028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.328005075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.328043938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.328052998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.328069925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.328116894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.328600883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.328639030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.328680992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.328685999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.328715086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.328732967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.329978943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.330018044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.330051899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.330056906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.330080986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.330096006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.338218927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.338259935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.338308096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.338311911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.338335037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.338357925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.340262890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.340298891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.340348005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.340353012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.340380907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.340394974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.341116905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.341149092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.341196060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.341200113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.341232061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.341249943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.408422947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.408463955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.408623934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.408631086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.408631086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.408641100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.408658028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.408678055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.408683062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.408696890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.408711910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.408730984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.416408062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.416440964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.416505098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.416510105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.416549921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.416910887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.416939974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.416977882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.416981936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.417009115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.417026997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.418621063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.418656111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.418699980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.418704033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.418745041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.427125931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.427160978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.427184105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.427187920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.427229881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.429189920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.429241896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.429265022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.429269075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.429292917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.429313898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.429764986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.429795980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.429821968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.429826975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.429868937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.496840954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.496882915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.496934891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.496942043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.496992111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.497221947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.497247934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.497276068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.497281075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.497308016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.497325897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.505037069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.505067110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.505160093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.505167961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.505213022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.505511999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.505542040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.505561113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.505565882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.505589008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.505609989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.507324934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.507344007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.507402897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.507410049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.507442951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.516721010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.516741991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.516804934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.516818047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.516829014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.516849041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.517883062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.517903090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.517947912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.517952919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.517968893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.517990112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.518260956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.518306017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.518317938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.518321991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.518346071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.518362045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.585655928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.585709095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.585751057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.585762978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.585802078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.586689949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.586709023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.586764097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.586770058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.586807013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.596968889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.596992970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597039938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597048998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597063065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597456932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597460032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597471952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597496033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597510099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597516060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597546101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597558975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597738981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597758055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597810030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.597815037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.597851038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.605494976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.605515003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.605555058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.605561018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.605604887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.606338024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.606364012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.606405973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.606410980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.606426001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.606450081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.606812000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.606831074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.606883049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.606888056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.606913090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.606934071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.674424887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.674448967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.674511909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.674526930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.674575090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.674592972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.674796104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.674828053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.674877882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.674884081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.674927950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.686949968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.686971903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687037945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.687042952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687083006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.687225103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687252045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687274933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.687279940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687309980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.687326908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.687689066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687706947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687760115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.687766075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.687802076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.695472956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.695517063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.695540905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.695545912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.695571899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.695590019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.696600914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.696641922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.696666956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.696671009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.696702003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.696719885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.697036982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.697082996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.697107077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.697112083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.697134972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.697156906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.763370037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.763432026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.763459921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.763484955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.763504028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.763519049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.763711929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.763756037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.763772011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.763782024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.763812065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.763820887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.775765896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.775820017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.775841951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.775850058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.775876999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.775893927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.776240110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.776283979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.776293039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.776313066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.776339054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.776356936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.776807070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.776849031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.776899099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.776910067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.776933908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.776954889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.784090042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.784111977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.784156084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.784162998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.784183979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.784205914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.784889936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.784907103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.784964085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.784971952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.785015106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.785296917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.785311937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.785363913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.785371065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.785408020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.852327108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.852391958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.852638960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.852653980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.852699995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.852727890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.852768898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.852792978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.852798939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.852821112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.852843046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.864942074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.864998102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865068913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.865075111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865187883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865241051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865261078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.865267992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865281105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.865355015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.865755081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865794897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865822077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.865828037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.865845919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.865866899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.873172045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.873256922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.873281002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.873346090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.874047995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.874089956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.874115944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.874125004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.874139071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.874174118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.874519110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.874562025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.874587059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.874593019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.874618053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.874639034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.941759109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.941831112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.941881895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.941896915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.941922903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.941940069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.941972971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.942020893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.942047119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.942054033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.942084074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.942100048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.954128981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.954171896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.954201937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.954209089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.954411983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.954411983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.954478979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.954523087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.954543114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.954550028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.954574108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.954596043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.955231905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.955274105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.955302954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.955307961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.955331087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.955348969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.961901903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.961941957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.961971045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.961977959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.961999893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.962023020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.962608099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.962668896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.962682962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.962691069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.962718964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.962739944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.962919950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.962976933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.962999105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.963006020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:05.963028908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:05.963052988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.030026913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.030056953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.030235052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.030262947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.030303955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.030524969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.030545950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.030591011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.030601978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.030642033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.042191982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.042236090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.042377949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.042377949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.042409897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.042459011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.045483112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.045533895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.045563936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.045572042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.045605898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.045629025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.045855045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.045896053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.045912981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.045919895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.045949936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.045968056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.050474882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.050519943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.050612926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.050612926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.050664902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.050705910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.051186085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.051232100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.051285982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.051294088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.051311016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.051331997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.052620888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.052664995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.052697897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.052705050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.052743912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.118959904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.118988037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.119024038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.119030952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.119065046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.119081020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.119338989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.119359016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.119385004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.119391918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.119420052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.119436026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.134268999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.134289026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.134334087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.134341955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.134356976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.134377956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.141896009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.141918898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.141973972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.141982079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142013073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142031908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142213106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142231941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142261028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142266989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142296076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142312050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142575026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142594099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142640114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142647028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142664909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142688990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.142955065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.142980099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.143018007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.143026114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.143045902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.143071890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.143321991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.143341064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.143382072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.143388033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.143429995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.214699984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.214724064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.214761972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.214782953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.214795113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.214821100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.215677977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.215698004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.215734959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.215739965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.215756893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.215780020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.228574038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.228606939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.228650093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.228656054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.228681087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.228707075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.236362934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.236397028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.236478090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.236495018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.236519098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.236535072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.236679077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.236700058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.236730099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.236736059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.236761093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.236778021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237128019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237147093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237183094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237189054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237212896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237221956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237492085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237510920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237546921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237551928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237596989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237627983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237828016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237848043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237886906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237893105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.237919092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.237932920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.303515911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.303586960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.303622007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.303631067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.303683996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.304299116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.304352045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.304389000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.304402113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.304414034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.304435015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.320467949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.320533037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.320544004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.320563078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.320585966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.320601940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325122118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325186968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325200081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325212002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325237989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325254917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325565100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325607061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325618982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325630903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325654984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325670958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325880051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325933933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325954914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.325968027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.325985909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326001883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326119900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.326167107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.326191902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326200008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.326225042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326242924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326415062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.326462984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.326481104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326487064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.326510906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.326527119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.392272949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.392335892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.392349958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.392364025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.392381907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.392401934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.393014908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.393064022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.393102884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.393109083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.393146992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.410623074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.410670042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.410701036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.410711050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.410742044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.410758972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.415827036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.415874958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.415904999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.415910959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.415951967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416265011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416313887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416332960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416341066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416366100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416383982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416508913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416555882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416568995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416588068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416606903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416625023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416747093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416790009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416810036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416817904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.416837931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.416877985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.417201042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.417243958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.417263985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.417272091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.417294025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.417309999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.480859995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.480906963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.480961084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.480993032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.481013060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.481029987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.481710911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.481750011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.481782913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.481789112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.481828928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.497819901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.497864008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.497910023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.497920036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.497934103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.497956991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.504162073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.504204988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.504245043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.504252911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.504295111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505151987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505206108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505239010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505244970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505275965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505292892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505527973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505569935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505593061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505601883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505628109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505646944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505882025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505923033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505943060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.505950928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.505992889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.506011009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.506345987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.506385088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.506416082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.506422043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.506453991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.506469011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.569961071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.570008993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.570060968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.570069075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.570108891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.570781946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.570837975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.570848942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.570863962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.570890903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.570908070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.586445093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.586488962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.586519003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.586525917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.586566925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.593763113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.593822002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.593857050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.593883991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.593899965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.593924999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594300032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594341040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594367981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594377995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594391108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594413996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594547987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594588041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594605923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594614029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594634056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594655991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594679117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594722033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594736099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594743013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.594770908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.594789028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.595253944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.595294952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.595319033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.595330000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.595349073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.595365047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.658282042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.658323050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.658417940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.658437014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.658483982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.659044981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.659065962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.659113884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.659121037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.659146070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.659159899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.675205946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.675271988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.675327063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.675359964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.675478935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.675478935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.682387114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.682445049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.682487965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.682514906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.682533979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.682554007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.683103085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.683152914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.683181047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.683192968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.683207989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.683227062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.683578014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.683629990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.683660984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.683674097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.683710098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.684391975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.684439898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.684489965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.684499979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.684524059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.684535027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.684631109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.684672117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.684686899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.684695005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.684724092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.684745073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.747952938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.747986078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.748258114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.748284101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.748399019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.748749018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.748776913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.748816013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.748823881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.748850107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.748864889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.764337063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.764406919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.764444113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.764467955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.764606953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.764606953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.770781040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.770829916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.770865917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.770884991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.770898104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.770920038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.772685051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.772726059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.772756100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.772769928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.772788048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.772805929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.773080111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.773145914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.773166895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.773176908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.773197889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.773214102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.773363113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.773413897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.773437023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.773446083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.773466110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.773485899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.774450064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.774490118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.774517059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.774524927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.774552107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.774569988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.837589979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.837626934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.837760925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.837778091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.837816954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.837969065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.837990999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.838021040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.838027954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.838048935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.838063955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.854310036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.854367018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.854402065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.854419947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.854449034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.854471922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.859545946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.859586000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.859639883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.859647989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.859699011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.861036062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.861072063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.861103058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.861109972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.861123085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.861141920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.861916065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.861962080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.861993074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.861999035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.862026930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.862040997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.862551928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.862595081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.862622023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.862628937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.862651110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.862672091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.862972021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.863014936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.863043070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.863049030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.863065958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.863087893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.926199913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.926254034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.926311970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.926327944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.926356077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.926374912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.926537037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.926577091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.926601887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.926609039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.926631927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.926647902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.942970037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.943001032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.943038940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.943048954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.943074942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.943094015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.948332071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.948369980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.948415995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.948424101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.948451996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.948467016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.949685097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.949709892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.949760914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.949767113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.949801922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.950541973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.950567007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.950614929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.950620890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.950644016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.950668097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.951154947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.951175928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.951215029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.951220989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.951246023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.951261997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.951534986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.951560020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.951590061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.951595068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:06.951620102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:06.951634884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.015360117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.015425920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.015433073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.015456915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.015480042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.015500069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.015625954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.015683889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.015711069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.015719891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.015736103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.015750885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.032059908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.032113075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.032150984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.032164097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.032186031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.032202959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.037127018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.037173033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.037200928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.037209034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.037230968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.037250996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.038535118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.038575888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.038604021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.038609982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.038634062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.038650036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.039196968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.039237976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.039263964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.039269924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.039302111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.039320946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.039905071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.039947033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.039967060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.039975882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.039994955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.040014029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.040575027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.040615082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.040641069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.040647984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.040668964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.040687084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.103638887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.103699923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.103816986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.103833914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.103889942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.103939056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.103940010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.103971958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.103972912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.104001999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.104028940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.120671988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.120718956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.120836973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.120846033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.121045113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.125696898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.125755072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.125782967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.125790119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.125812054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.125830889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.127156973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.127199888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.127235889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.127243042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.127305984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.127305984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.127911091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.127973080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.127985001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.127996922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.128020048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.128046036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.128695011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.128737926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.128767014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.128772974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.128788948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.128813028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.129112005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.129156113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.129173040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.129180908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.129199982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.129225969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.192312956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.192348003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.192456961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.192467928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.192521095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.192614079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.192635059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.192662954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.192668915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.192691088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.192713022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.209566116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.209598064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.209692001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.209702015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.209897995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.214433908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.214462042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.214544058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.214550972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.214591980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.215708971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.215729952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.215778112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.215784073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.215825081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.216670990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.216691971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.216751099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.216757059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.216795921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.217492104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.217513084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.217569113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.217580080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.217617989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.217820883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.217840910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.217890024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.217895031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.217931032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.280956984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.280988932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.281071901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.281080008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.281121016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.282083035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.282107115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.282167912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.282174110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.282213926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.298468113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.298496962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.298532009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.298538923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.298578978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.302923918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.302947044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.302999973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.303005934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.303044081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.304374933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.304395914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.304436922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.304442883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.304454088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.304472923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.305228949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.305247068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.305289030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.305294991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.305309057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.305339098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.306097031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.306114912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.306162119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.306166887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.306201935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.306453943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.306478977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.306509972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.306514978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.306528091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.306545973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.369558096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.369591951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.369817972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.369837999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.369883060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.370729923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.370752096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.370794058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.370800018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.370840073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.387108088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.387131929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.387200117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.387207985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.387245893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.391952038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.391973019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.392021894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.392028093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.392049074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.392072916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.393368959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.393388987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.393445969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.393451929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.393488884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.393901110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.393922091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.393965006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.393970966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.393990993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.394012928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.395216942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.395236969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.395287991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.395293951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.395318985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.395340919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.395497084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.395517111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.395541906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.395548105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.395570993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.395591021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.458261967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.458286047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.458369017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.458379984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.458417892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.459136963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.459156036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.459182978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.459188938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.459213972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.459234953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.475789070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.475810051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.475867987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.475873947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.475914955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.480568886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.480590105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.480637074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.480643034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.480664015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.480684996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.481776953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.481797934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.481847048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.481853008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.481898069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.482486963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.482506990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.482533932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.482538939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.482559919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.482582092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.483396053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.483419895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.483447075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.483452082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.483481884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.483491898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.483719110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.483741045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.483783960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.483788967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.483809948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.483829021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.546827078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.546857119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.546957016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.546969891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.547010899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.548166037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.548190117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.548232079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.548239946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.548265934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.548283100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.564460993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.564496040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.564544916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.564553022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.564594030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.569206953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.569226980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.569279909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.569286108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.569333076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.569333076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.571513891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.571536064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.571573973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.571578979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.571616888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.571742058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.571763039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.571788073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.571794033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.571813107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.571835041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.572069883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.572088957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.572123051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.572128057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.572149992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.572176933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.572711945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.572732925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.572772026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.572777033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.572792053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.572810888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.636353016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.636375904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.636471033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.636487007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.636528015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.637036085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.637054920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.637082100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.637087107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.637130976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.637146950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.653243065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.653264046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.653335094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.653342009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.653393984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.657816887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.657836914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.657871962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.657880068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.657901049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.657922983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.659846067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.659868002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.659900904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.659905910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.659925938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.659945011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.660177946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.660202980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.660229921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.660235882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.660260916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.660275936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.660948038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.660967112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.661007881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.661014080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.661034107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.661048889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.661541939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.661566019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.661669016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.661674023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.661716938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.661716938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.730561972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.730628967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.730760098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.730779886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.730792999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.730823994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.730952978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.730999947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.731026888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.731033087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.731062889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.731080055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.743773937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.743824959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.743911028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.743921995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.744071960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.746720076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.746769905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.746851921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.746851921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.746860981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.746900082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.748905897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.748949051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.748984098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.748991966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.749022961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.749043941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.749221087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.749263048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.749289036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.749294996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.749316931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.749339104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.749907970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.749954939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.749984026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.749989986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.750021935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.750037909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.750312090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.750360966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.750408888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.750416040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.750459909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.750475883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.819536924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.819566965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.819607973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.819619894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.819634914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.819664001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.819958925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.819977999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.820008993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.820014954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.820044041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.820055962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.832875013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.832896948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.832935095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.832943916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.832972050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.832993984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.835460901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.835484028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.835515976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.835521936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.835546017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.835566044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.837615967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.837641001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.837678909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.837685108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.837713003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.837734938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.837879896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.837899923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.837927103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.837932110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.837951899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.837979078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.838242054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.838263035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.838351965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.838351965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.838360071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.838392973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.838927031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.838944912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.838984966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.838990927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.839010954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.839031935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.908158064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.908186913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.908298969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.908324003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.908366919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.908453941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.908472061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.908499002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.908504963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.908528090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.908548117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.921449900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.921472073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.921555996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.921565056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.921605110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.925486088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.925508022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.925594091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.925594091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.925601959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.925638914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.928251028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.928271055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.928333044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.928339005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.928359032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.928380966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.928384066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.928397894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.928412914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.928445101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.929465055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.929483891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.929522038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.929527998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.929543972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.929552078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.929577112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.929594040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.929599047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.929631948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.929661989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.997015953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.997057915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.997097969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.997106075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.997134924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.997152090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.997241974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.997262955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.997328043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.997328043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:07.997335911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:07.997369051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.010240078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.010272026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.010340929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.010348082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.010396004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.010409117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.012826920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.012856007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.012912035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.012919903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.013149023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.013149023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.016896009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.016921043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.016992092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.016999006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017030954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017050982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017174006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017200947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017232895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017239094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017256975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017281055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017543077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017565012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017600060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017605066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.017637014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.017653942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.019781113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.019805908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.019855976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.019862890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.019887924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.019911051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.085655928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.085695982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.085757971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.085767031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.085808992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.085966110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.085997105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.086031914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.086038113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.086057901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.086088896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.099255085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.099273920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.099354029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.099359989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.099406004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.101830959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.101859093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.101918936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.101923943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.101959944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.102005959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.105675936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.105695963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.105756044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.105762005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.105792046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.105811119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.106057882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.106086969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.106129885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.106134892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.106164932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.106177092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.106292009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.106317043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.106350899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.106355906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.106381893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.106398106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.173736095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.173764944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.173835993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.173844099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.173887968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.174259901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.174279928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.174334049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.174339056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.174387932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.187514067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.187537909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.187664986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.187673092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.187772989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.187908888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.187932968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.188014984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.188020945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.188111067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194056034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194087029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194128036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194134951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194155931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194178104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194329023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194350004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194401026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194406986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194447041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194705009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194725990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194763899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194768906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194804907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194814920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194838047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194861889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194866896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.194889069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.194907904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.262672901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.262697935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.262775898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.262785912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.262830973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.263040066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.263060093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.263118029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.263124943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.263164997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.276752949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.276772022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.276835918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.276842117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.276864052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.276886940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.277129889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.277149916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.277199984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.277205944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.277226925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.277249098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.282794952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.282815933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.282891035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.282896042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.282934904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283119917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283142090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283193111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283199072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283237934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283492088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283512115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283562899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283569098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283607006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283761024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283782005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283828020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283833981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.283854008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.283873081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.351362944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.351382971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.351449966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.351457119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.351495981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.351748943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.351768017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.351824999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.351830959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.351857901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.351898909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.365243912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.365268946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.365349054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.365355968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.365400076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.365773916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.365792990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.365852118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.365858078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.365895987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.374501944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.374521017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.374603987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.374609947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.374650955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.374934912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.374957085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.374999046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375004053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375025034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375049114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375396967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375416994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375468016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375473022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375511885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375737906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375767946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375793934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375798941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.375832081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.375849009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.440200090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.440222979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.440323114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.440332890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.440376043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.440505981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.440526962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.440566063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.440571070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.440593004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.440613031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.454010963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.454032898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.454083920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.454091072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.454118013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.454135895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.454799891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.454818010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.454859972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.454865932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.454891920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.454914093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.463169098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.463191032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.463249922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.463255882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.463291883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.463550091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.463567972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.463614941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.463620901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.463640928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.463663101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.464029074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.464049101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.464095116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.464101076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.464122057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.464143991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.464265108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.464283943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.464334965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.464340925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.464375973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.528768063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.528791904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.528853893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.528862953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.528909922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.529253006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.529277086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.529309988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.529316902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.529339075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.529357910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.542499065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.542522907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.542558908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.542565107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.542597055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.542608976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.543330908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.543354034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.543391943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.543397903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.543421030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.543442965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.551758051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.551779985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.551814079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.551820040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.551841974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.551865101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.552205086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552225113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552268982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.552274942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552295923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.552316904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.552614927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552634001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552689075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.552695036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552731037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.552958965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.552980900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.553020954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.553025961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.553049088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.553071022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.617609978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.617641926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.617743015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.617791891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.617808104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.617820978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.617882013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.631448030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.631484985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.631534100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.631541014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.631558895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.631582022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.632177114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.632205963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.632249117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.632255077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.632276058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.632304907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.640928984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.640950918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641012907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.641024113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641067028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.641217947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641237974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641287088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.641294003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641331911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.641765118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641805887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641833067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.641839027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.641861916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.641887903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.642008066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.642050982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.642076969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.642082930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.642101049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.642126083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.706558943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.706634045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.706736088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.706753016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.706785917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.706800938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.706931114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.706980944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.707010984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.707016945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.707043886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.707060099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.720778942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.720830917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.720869064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.720880985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.720901012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.720922947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.721225023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.721267939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.721295118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.721302032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.721324921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.721343994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.729422092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.729468107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.729500055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.729507923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.729532003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.729552984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.730505943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.730555058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.730617046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.730623007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.730655909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.730783939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.730844975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.730892897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.730976105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.731179953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.731220007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.731246948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.731252909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.731275082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.731291056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.795167923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.795208931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.795277119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.795288086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.795319080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.795341969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.795882940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.795952082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.795972109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.795980930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.796005011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.796025038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.809398890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.809427023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.809578896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.809587955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.809628963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.810159922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.810221910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.810257912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.810264111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.810297966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.818074942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.818128109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.818159103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.818166018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.818188906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.818209887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.818830967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.818892956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.818927050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.818933010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.818979979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.819153070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.819195032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.819216013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.819224119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.819247961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.819263935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.819545984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.819600105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.819626093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.819632053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.819657087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.819678068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.884002924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.884076118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.884124994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.884140968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.884179115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.884202003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.884318113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.884371996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.884399891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.884407043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.884428978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.884449005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.898082972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.898124933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.898159981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.898165941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.898197889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.898216963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.898650885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.898696899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.898727894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.898734093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.898755074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.898778915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.906591892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.906639099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.906667948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.906673908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.906697035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.906717062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.907619953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.907660961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.907749891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.907756090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.907804966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.908015966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.908056021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.908077955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.908086061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.908107996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.908128023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.908636093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.908675909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.908710003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.908715963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.908759117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.973951101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.973998070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.974065065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.974072933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.974112034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.974138021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.974217892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.974263906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.974308014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.974313974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.974340916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.974359035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.987221003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.987267971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.987301111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.987308025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.987330914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.987355947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.987668991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.987710953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.987741947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.987747908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:08.987771988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:08.987797976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.004729033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.004776955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.004807949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.004815102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.004848957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.004864931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005023956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005072117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005099058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005105019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005135059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005147934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005609989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005666018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005697966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005702972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005726099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005748987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005831957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005881071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005899906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.005907059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.005949020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.062746048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.062789917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.062825918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.062834024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.062860012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.062880039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.062943935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.062984943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.063016891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.063023090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.063044071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.063071966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.075710058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.075752020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.075848103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.075848103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.075856924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.075923920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.076108932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.076148033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.076180935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.076186895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.076210022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.076229095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.084686995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.084728956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.084777117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.084785938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.084824085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.084824085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.093373060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.093415976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.093491077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.093501091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.093568087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.093568087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.093883991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.093924999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.093971968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.093978882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.094011068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.094027996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.094238997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.094280958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.094311953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.094317913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.094336987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.094362020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.151814938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.151864052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.151906013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.151925087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.151936054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.151968002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.152154922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.152194023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.152223110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.152230024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.152267933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.152267933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.164402962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.164443970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.164477110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.164490938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.164518118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.164576054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.164906025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.164946079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.164997101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.165002108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.165018082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.165043116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.173377991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.173445940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.173497915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.173507929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.173532963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.173556089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182092905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182140112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182177067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182187080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182218075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182233095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182485104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182523966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182558060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182564020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182589054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182602882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182838917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182882071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182912111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182918072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.182939053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.182964087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.240462065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.240541935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.240551949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.240571022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.240598917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.240624905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.240775108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.240816116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.240847111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.240854979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.240871906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.240894079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534013033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534049988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534149885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534177065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534315109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534333944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534353018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534399986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534405947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534441948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534661055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534679890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534722090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534729004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.534749985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.534765005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.535068035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535085917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535132885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.535140991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535176992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.535500050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535517931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535566092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.535572052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535605907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.535768986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535787106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535836935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.535842896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.535876989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.536246061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.536263943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.536314964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.536319971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.536350965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.536690950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.536709070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.536760092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.536765099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.536798000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537028074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537046909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537100077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537105083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537130117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537147045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537393093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537411928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537460089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537466049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537498951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537786961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537817001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537854910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537861109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.537888050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.537905931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538160086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538178921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538228035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538233995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538264990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538491964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538511038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538556099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538562059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538583040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538599968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538867950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538887978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538938046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.538944006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.538976908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.539267063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.539285898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.539339066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.539344072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.539376974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.539577007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.539598942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.539648056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.539654016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.539685011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.540038109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540056944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540107012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.540112019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540143967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.540333986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540350914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540400028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.540405989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540436983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.540684938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540704012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540752888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.540759087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.540791988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541069984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541089058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541146994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541152954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541184902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541491985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541512012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541558981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541563988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541595936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541759014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541776896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541822910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541829109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.541861057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.541985035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542006016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542037964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542043924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542067051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542081118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542151928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542228937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542279005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542284012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542304993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542309046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542330027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542334080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542346954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542363882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542393923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542404890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542423964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542450905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542455912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.542474985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.542490959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545236111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545257092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545305014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545312881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545345068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545351982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545370102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545391083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545396090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545423985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545443058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545444012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545454025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545474052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545483112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545489073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545514107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545526028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545532942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545537949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545557022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545568943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545592070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545595884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.545625925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.545638084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.595698118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.595737934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.595812082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.595889091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.595911026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.595952034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.595993996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.615261078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.615330935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.615369081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.615386963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.615426064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.615454912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.615998030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.616044998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.616075039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.616081953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.616108894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.616134882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.620737076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.620779037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.620842934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.620848894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.620872974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.620894909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626332998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626379967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626411915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626418114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626449108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626467943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626704931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626744986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626776934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626782894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626810074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626835108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626907110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626950026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.626990080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.626996040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.627007961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.627029896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.684343100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684370995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684426069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.684436083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684469938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684472084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.684495926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684514046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.684520960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684551001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.684556007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.684568882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.684593916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.703694105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.703720093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.703767061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.703778982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.703810930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.703810930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.704607010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.704627037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.704668045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.704674959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.704696894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.704716921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.715270996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.715296030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.715329885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.715339899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.715367079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.715380907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.716347933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.716371059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.716423035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.716429949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.716468096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.716715097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.716733932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.716763973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.716768980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.716797113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.717061043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.717120886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.717145920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.717178106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.717184067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.717211008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.717226982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.773222923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.773258924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.773297071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.773313046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.773341894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.773355961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.773582935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.773602009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.773632050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.773638964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.773664951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.773679972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.792112112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.792133093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.792207003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.792216063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.792500973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.793097019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.793117046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.793160915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.793167114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.793201923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.802757978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.802778006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.802825928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.802833080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.802980900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.802980900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804011106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804030895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804080009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804085970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804120064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804465055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804492950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804517984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804522991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804555893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804788113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804805994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804831028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804836988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.804855108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.804873943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.862077951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.862109900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.862274885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.862274885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.862308979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.862349033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.862529039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.862556934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.862585068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.862591028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.862618923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.862636089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.881445885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.881468058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.881685019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.881694078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.881732941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.881840944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.881866932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.881895065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.881900072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.881930113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.881946087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.891820908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.891891003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.891941071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.891958952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.892093897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.892093897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893127918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893177032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893217087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893224001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893249989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893275023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893440962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893511057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893543005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893548965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893573046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893595934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893815041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893863916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893894911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893902063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.893932104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.893949986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.950748920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.950795889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.950961113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.950985909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.951003075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.951036930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.951127052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.951127052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.951127052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.951136112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.951229095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.970182896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.970217943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.970273972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.970283985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.970329046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.970534086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.970556974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.970587969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.970592976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.970617056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.970633984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.980611086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.980638981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.980712891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.980720997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.980761051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.981597900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.981621027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.981687069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.981692076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.981729984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.981996059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.982021093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.982059956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.982065916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.982105970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.982122898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.982295990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.982316971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.982364893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:09.982369900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:09.982407093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.039755106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.039818048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.039891958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.039913893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.039935112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.039958954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.039962053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.039990902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.040031910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.040043116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.040061951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.040071964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.040096998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.040126085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.058809996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.058841944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.058917046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.058928013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.058964014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.058983088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.059173107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.059194088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.059222937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.059230089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.059257984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.059274912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.069217920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.069253922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.069433928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.069447994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.069493055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.070281029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070313931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070378065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.070384979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070425987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.070549011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070574999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070601940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.070607901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070635080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.070652962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.070954084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.070982933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.071018934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.071027994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.071062088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.071073055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.128674030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.128745079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.128776073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.128797054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.128823042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.128848076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.128957987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.128999949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.129029036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.129034996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.129059076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.129080057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.148178101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.148222923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.148260117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.148269892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.148297071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.148313046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.148346901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.148395061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.148421049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.148427010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.148444891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.148468018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.158350945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.158396006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.158430099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.158437967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.158633947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.158931971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.158979893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159008026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159014940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159039974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159060955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159286976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159327984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159348011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159357071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159379959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159398079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159704924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159753084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159779072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159786940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.159813881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.159835100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.217428923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.217503071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.217547894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.217576981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.217606068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.217622042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.217645884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.217689991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.217711926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.217720985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.217741013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.217760086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.236952066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237020016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237067938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.237093925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237118006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.237166882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237178087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.237185001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237220049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237231016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.237277985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.237283945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.237350941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.247116089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247153044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247376919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.247416973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247458935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.247795105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247818947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247848988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.247859955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247874975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.247895956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.247946024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247966051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.247996092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.248003960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.248027086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.248044968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.248588085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.248608112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.248636961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.248646021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.248667002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.248686075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.464852095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.464889050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465003967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465020895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465034008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465066910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465068102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465089083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465096951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465126991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465361118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465385914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465423107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465429068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465446949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465464115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465765953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465785980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465820074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465826035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465842962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465866089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.465945959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465971947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.465996981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466001987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466022015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466043949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466675997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466701031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466736078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466741085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466759920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466784954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466814995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466834068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466865063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466869116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466886997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466891050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466916084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466916084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466928959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.466943026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.466975927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467607021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467623949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467664003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467668056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467689037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467701912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467720032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467729092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467744112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467761993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467787027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467792034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467804909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467825890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467840910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467844963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.467869043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.467890978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.468525887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.468556881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.468584061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.468589067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.468615055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.468632936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.468681097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.468704939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.468736887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.468744040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.468794107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469249964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469384909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469415903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469441891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469446898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469470978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469486952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469516993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469535112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469563007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469567060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469588995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469598055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469605923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469609976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469625950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469650984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469654083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.469675064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.469696045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.483200073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.483243942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.483297110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.483305931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.483338118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.483354092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.483481884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.483529091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.483558893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.483563900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.483592987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.483604908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.504952908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.504997969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.505048990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.505060911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.505083084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.505110025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.505582094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.505620003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.505645990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.505650997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.505672932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.505683899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.520684004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.520736933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.520804882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.520816088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.520850897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.520869970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.521424055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.521464109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.521481991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.521490097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.521517038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.521534920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.521785021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.521822929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.521838903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.521845102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.521883011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.522253990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.522294044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.522311926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.522319078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.522341967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.522360086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.533294916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.571930885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.571964025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.572038889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.572046041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.572066069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.572082996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.572107077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.572129965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.572134018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.572171926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.593997955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.594073057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.594129086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.594142914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.594165087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.594191074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.594835043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.594880104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.594909906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.594916105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.594949961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.594966888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616365910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616389990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616434097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616467953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616518021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616559982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616600990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616678953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616698980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616729021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616740942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616767883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616786003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616821051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616847992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616871119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616875887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.616895914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.616918087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.660558939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.660590887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.660674095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.660698891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.660742044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.660844088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.660864115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.660887957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.660892963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.660923004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.660940886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.682446957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.682466984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.682533979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.682543993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.682588100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.683232069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.683252096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.683289051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.683294058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.683315992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.683339119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.706479073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.706506968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.706557989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.706563950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.706594944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.706610918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.706816912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.706839085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.706877947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.706882000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.706898928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.706918955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.707150936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.707170010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.707195997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.707201004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.707233906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.707248926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.707405090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.707423925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.707469940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.707473993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.707499981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.707511902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.749259949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.749294996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.749345064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.749356985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.749370098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.749387980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.749407053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.749408007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.749427080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.749439001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.749473095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.771080971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.771122932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.771168947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.771179914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.771205902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.771223068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.771711111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.771733046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.771759987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.771764994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.771795988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795320034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795383930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795398951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795413971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795435905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795459032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795531988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795578957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795595884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795600891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795641899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795651913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.795950890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.795995951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.796022892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.796027899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.796051979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.796072960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.796235085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.796273947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.796309948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.796314955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.796334982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.796359062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.838382006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.838432074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.838565111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.838597059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.838641882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.838641882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.838670969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.838711977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.838742971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.838756084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.838782072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.838803053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.859770060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.859805107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.859869003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.859889984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.859925985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.859942913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.860717058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.860734940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.860771894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.860776901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.860797882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.860820055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.884192944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.884243011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.884293079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.884316921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.884344101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.884360075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.884680033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.884720087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.884749889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.884756088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.884797096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.884798050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.885170937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.885214090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.885252953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.885257959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.885291100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.885303020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.885457993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.885499954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.885524035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.885529041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.885549068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.885570049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.928395987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.928452969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.928528070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.928548098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.928572893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.928596973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.928620100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.928662062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.928694010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.928705931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.928725958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.928742886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.948843956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.948868990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.948934078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.948951960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.948977947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.948997974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.949526072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.949554920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.949606895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.949620008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.949640989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.949666023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.972819090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.972863913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.972929955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.972946882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.972980976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973227024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.973262072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973279953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.973293066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973314047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.973340988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973372936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973807096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.973846912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.973876953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973881960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.973900080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.973922968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.974086046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.974127054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.974157095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.974160910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:10.974186897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:10.974198103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.017174006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.017215967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.017263889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.017271996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.017309904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.017318964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.017579079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.017618895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.017648935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.017653942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.017676115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.017694950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.037395954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.037441015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.037519932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.037528038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.037587881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.038554907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.038594961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.038624048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.038629055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.038651943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.038670063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.061886072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.061913013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.061959982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.061966896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.061989069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.062015057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.062767029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.062791109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.062838078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.062843084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.062882900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.062910080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.062985897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.063004971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.063030005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.063034058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.063060999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.063082933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.063297987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.063323975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.063359976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.063364983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.063395977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.063407898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.105811119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.105858088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.105894089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.105912924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.105938911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.105958939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.106034040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.106076002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.106106043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.106112003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.106129885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.106148005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.126405001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.126450062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.126497030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.126504898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.126537085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.126559019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.127194881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.127235889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.127264023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.127269983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.127309084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151226997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151248932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151340008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151382923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151439905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151577950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151597023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151624918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151638985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151665926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151684999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151813030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151834965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151861906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151868105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.151896000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.151911974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.152028084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.152046919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.152070045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.152074099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.152113914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.194426060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.194469929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.194587946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.194677114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.194720030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.194725037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.194762945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.194777012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.194803953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.194809914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.194839954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.194869041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.215204000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.215243101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.215291023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.215308905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.215363979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.215364933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.215890884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.215931892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.215965033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.215970039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.216011047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240019083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240063906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240147114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240147114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240166903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240214109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240464926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240523100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240545988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240561008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240575075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240629911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240663052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240720987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240768909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240773916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.240799904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.240820885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.241146088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.241188049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.241238117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.241245031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.241292953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.241292953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.283677101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.283750057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.283900976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.283907890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.283951044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.283951998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.283982992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.284008026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.284034014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.284043074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.284060001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.284085035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.284121037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.304435968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.304512024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.304526091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.304536104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.304582119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.305007935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.305048943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.305059910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.305088043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.305092096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.305134058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.328979969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329026937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329055071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329062939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329094887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329101086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329219103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329265118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329297066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329303026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329324961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329334021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329428911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329473972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329493046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329499960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329533100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329826117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329869032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329898119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.329901934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.329942942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.332180023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.373148918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.373198032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.373224974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.373234987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.373250961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.373269081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.373352051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.373389959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.373410940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.373416901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.373435020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.373454094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.393254995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.393309116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.393450022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.393459082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.393501997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.393668890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.393712044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.393738031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.393743038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.393771887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.393795013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.417869091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.417926073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418086052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418086052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418102026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418147087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418289900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418360949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418370962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418385983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418420076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418442011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418545008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418591022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418617010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418622017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.418644905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418665886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.418982029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.419030905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.419059992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.419070005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.419097900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.419116020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.461915016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.461935997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.462039948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.462049007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.462070942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.462086916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.462327957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.462347031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.462377071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.462379932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.462404966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.462419987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.481712103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.481734991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.481924057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.481933117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.481981039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.482460976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.482481003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.482551098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.482556105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.482604980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.506499052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.506521940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.506598949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.506609917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.506659985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.506890059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.506913900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.506942987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.506947041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.506973028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.506990910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.507133961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.507153034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.507185936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.507189989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.507214069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.507234097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.507527113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.507544041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.507596970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.507602930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.507639885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.550578117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.550602913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.550672054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.550688028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.550729036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.551095009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.551116943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.551156998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.551162004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.551184893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.551202059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.570432901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.570457935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.570501089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.570507050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.570533037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.570550919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.571599007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.571616888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.571661949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.571667910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.571696043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.571707964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.595407963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.595442057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.595530987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.595536947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.595578909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.595911026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.595928907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.595988035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.595993042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596033096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.596381903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596400023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596451998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.596457958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596503973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.596822977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596844912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596909046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.596911907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.596947908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.639172077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.639205933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.639269114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.639285088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.639301062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.639322042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.639913082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.639931917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.639986038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.639997005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.640022039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.640043974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.659216881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.659236908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.659305096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.659320116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.659352064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.660140038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.660157919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.660278082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.660286903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.660326958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.683816910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.683834076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.683908939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.683933020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.683973074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684199095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684216022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684281111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684286118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684334040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684604883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684623003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684689045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684694052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684731007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684855938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684873104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684910059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684915066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.684937000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.684957027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.727910995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.727935076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.728003979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.728013039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.728049994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.728585005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.728601933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.728646040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.728653908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.728663921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.728691101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.748233080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.748260975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.748429060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.748442888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.748505116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.749886990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.749913931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.749974012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.749980927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.750020027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.772430897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.772456884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.772524118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.772545099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.772598982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.772924900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.772943020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773000002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773006916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773046017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773262978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773281097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773328066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773334980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773350000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773375034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773511887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773530960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773572922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773577929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.773613930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.773634911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.816603899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.816628933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.816718102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.816744089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.816787004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.817405939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.817430019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.817486048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.817492962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.817528009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.836560011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.836580038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.836639881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.836663961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.836697102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.837692022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.837716103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.837747097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.837753057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.837785006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.861287117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.861309052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.861423969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.861454010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.861495018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.861552000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.861568928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.861589909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.861601114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.861624002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.861644030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.862122059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.862140894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.862207890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.862214088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.862251043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.862335920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.862351894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.862428904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.862435102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.862466097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.862473011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.911149025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.911186934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.911206961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.911216021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.911236048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.911253929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.913480997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.913500071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.913554907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.913563013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.913597107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.933331013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.933356047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.933408976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.933418989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.933443069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.933463097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.934111118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.934132099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.934160948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.934171915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.934197903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.934217930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.955754042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.955773115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.955815077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.955826998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.955838919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.955878973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956163883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956218958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956346035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956404924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956537008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956566095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956607103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956614971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956625938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956650019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956779003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956801891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956835985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956840992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.956865072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.956882954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.999759912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.999789953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.999862909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.999883890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:11.999898911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:11.999921083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.002321005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.002346992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.002429008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.002434969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.002489090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.022030115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.022048950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.022116899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.022135019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.022151947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.022173882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.022794008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.022815943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.022878885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.022891045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.022927046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.045306921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.045326948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.045406103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.045427084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.045475960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.045634985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.045654058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.045711040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.045718908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.045756102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.046051979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.046070099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.046132088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.046139002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.046149015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.046192884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.046266079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.046283960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.046315908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.046322107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.046350956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.046366930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.088258982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.088279963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.088393927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.088421106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.088470936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.091268063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.091289997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.091340065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.091346979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.091382980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.110727072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.110743999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.110805035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.110820055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.110852957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.111466885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.111485004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.111535072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.111541033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.111562014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.111582041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.134393930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.134413958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.134517908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.134541988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.134618044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.134706974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.134725094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.134777069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.134782076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.134824991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.135088921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.135107994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.135134935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.135140896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.135165930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.135188103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.135420084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.135438919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.135490894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.135495901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.135510921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.135536909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.178288937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.178314924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.178472996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.178508043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.178585052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.180512905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.180532932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.180599928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.180622101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.180668116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.199249983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.199269056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.199404001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.199419975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.199460983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.200103045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.200120926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.200176954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.200184107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.200222969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.222842932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.222861052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.222995996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223010063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223063946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223064899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223078012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223100901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223123074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223129034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223159075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223176956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223427057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223449945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223499060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223505020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223537922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223647118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223664045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223711014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.223715067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.223757982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.275144100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.275218010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.275298119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.275351048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.275381088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.275401115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.275432110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.275474072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.275511026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.275521994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.275537014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.275563002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.288011074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.288060904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.288151979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.288187027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.288208008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.288234949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.288862944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.288907051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.288963079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.288969994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.289017916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.321436882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.321486950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.321532965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.321552038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.321568012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.321594000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.321680069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.321723938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.321753979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.321760893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.321790934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.321819067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.322027922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.322093010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.322103977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.322122097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.322158098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.322180033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.322498083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.322540998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.322566986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.322572947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.322608948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.322633028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.363893032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.363946915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.364000082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.364017963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.364063025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.364363909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.364404917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.364438057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.364444971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.364470005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.364502907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.376837969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.376883984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.376936913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.376945972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.377001047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.395157099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.395205021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.395253897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.395276070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.395303965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.395334005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410121918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410176039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410240889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410264969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410279036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410325050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410389900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410430908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410517931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410523891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410577059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410590887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410634041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410667896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410675049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.410701990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.410732985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.411178112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.411235094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.411271095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.411278009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.411309958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.411334038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.452574015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.452644110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.452816963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.452827930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.452917099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.453047037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.453105927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.453119040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.453126907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.453174114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.465569973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.465624094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.465740919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.465748072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.465799093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.493043900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.493099928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.493129015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.493139982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.493413925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.500663996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.500711918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.500751972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.500760078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.500807047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.500925064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.500966072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.500989914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.500996113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501022100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.501049995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.501415014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501458883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501497984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.501511097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501553059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.501579046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.501728058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501770020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501799107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.501806021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.501861095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.541470051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.541503906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.541585922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.541599989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.541646957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.542321920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.542344093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.542390108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.542397976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.542442083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.554135084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.554158926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.554235935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.554250002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.554292917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.581861019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.581886053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.581958055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.581967115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.582016945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.582039118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.589335918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.589381933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.589437008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.589445114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.589495897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.589687109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.589730024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.589760065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.589766026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.589787006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.589818001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.590159893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.590212107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.590257883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.590264082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.590291023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.590316057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.590444088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.590483904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.590503931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.590512037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.590554953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.630183935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.630233049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.630320072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.630331039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.630353928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.630381107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.631025076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.631071091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.631112099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.631118059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.631165981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.642949104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.642995119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.643035889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.643047094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.643110037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.670703888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.670768023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.670844078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.670855045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.670917988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678119898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678160906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678205013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678210974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678236008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678268909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678414106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678455114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678488016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678493023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678529978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678555965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678755045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678792953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678826094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678832054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.678884029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.678915024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.679128885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.679169893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.679204941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.679210901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.679260969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.724886894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.724939108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.725064993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.725085020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.725120068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.725147009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.725640059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.725683928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.725723028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.725728989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.725779057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.742144108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.742192030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.742341995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.742360115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.742466927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.760407925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.760452032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.760588884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.760597944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.760699987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.768934965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.768976927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769027948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769035101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769093037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769608021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769660950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769694090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769700050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769726992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769757986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769814968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769885063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769889116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769918919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.769949913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.769975901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.770082951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.770127058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.770159960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.770165920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.770204067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.770226002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.815372944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.815393925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.815541983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.815551996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.815680981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.815745115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.815762997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.815850019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.815855980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.815944910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.832004070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.832024097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.832144022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.832151890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.832248926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.848952055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.848983049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.849303961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.849328041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.849447966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.856775045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.856800079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.856872082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.856878996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.856921911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.856946945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857116938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857136011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857184887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857192993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857228994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857261896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857481956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857500076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857544899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857551098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857595921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857620955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857793093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857814074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857871056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.857877970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.857929945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.904267073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.904295921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.904378891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.904392004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.904547930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.904547930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.904731035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.904769897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.904805899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.904813051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.904864073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.920463085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.920547009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.920676947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.920676947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.920686960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.920732021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.938368082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.938405991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.938477993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.938488960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.938539982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.945905924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.945946932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.945993900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946002007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946017027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946047068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946146965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946167946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946207047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946214914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946228981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946254969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946330070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946348906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946409941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946417093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946458101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946777105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946794987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946844101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946851015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.946866989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.946891069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.993165016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.993210077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.993272066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.993288040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.993323088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.993341923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.993665934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.993705034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.993735075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.993741989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:12.993779898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:12.993802071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.009260893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.009308100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.009377956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.009390116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.009433985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.026954889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.027034998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.027100086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.027108908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.027121067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.027159929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.034337044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.034358978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.034477949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.034486055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.034538031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.034790993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.034811020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.034884930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.034892082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.034936905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.034995079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.035015106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.035068989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.035075903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.035126925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.035355091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.035377026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.035442114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.035449028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.035500050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.092945099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.093012094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.093144894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.093158960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.093189955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.093234062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.093239069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.093296051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.093307018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.093365908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.100681067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.100732088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.100819111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.100847960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.100882053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.100903988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.116992950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.117050886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.117121935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.117130995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.117206097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.124656916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.124701023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.124732971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.124739885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.124792099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125060081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125101089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125128031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125134945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125164032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125185013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125190973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125217915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125251055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125266075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125287056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125296116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125332117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125361919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125570059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125612020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125644922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125650883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.125690937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.125713110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.181233883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.181282997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.181324005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.181340933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.181375980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.181400061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.181618929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.181659937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.181677103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.181687117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.181718111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.181742907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.189120054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.189162016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.189183950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.189193964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.189275980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.191031933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.205610991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.205657959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.205687046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.205697060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.205727100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.205749989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.213778019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.213874102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.213881016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.213968992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.213993073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214020967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214107990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214147091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214163065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214174986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214201927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214226961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214289904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214332104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214363098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214369059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214401960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214422941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214447021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214485884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214514971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214520931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.214550018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.214570999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.269661903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.269728899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.269773960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.269785881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.269846916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.270009995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.270054102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.270137072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.270143986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.270167112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.270190001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.278501987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.278556108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.278594971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.278608084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.278639078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.278666019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.294940948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.295003891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.295034885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.295052052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.295073986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.295100927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.302443027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.302521944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.302525997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.302546978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.302603960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.302793980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.302834988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.302871943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.302879095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.302891970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.302933931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.303275108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.303366899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.303399086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.303405046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.303515911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.303586006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.303586006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.303586006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.303601027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.303630114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.303663015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.303699970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.359014988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.359036922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.359112978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.359123945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.359163046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.359185934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.359189034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.359199047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.359222889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.359276056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.367405891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.367449045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.367491007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.367497921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.367552042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.383636951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.383677959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.383721113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.383728027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.383761883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.383783102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.391448975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.391493082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.391524076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.391530991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.391565084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.391587973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.391685963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.391722918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.391752005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.391758919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.391788960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.391812086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.392005920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.392045975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.392074108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.392081022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.392107010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.392127037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.392301083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.392339945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.392364025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.392371893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.392400026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.392426014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.447139978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.447161913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.447304010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.447314978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.447369099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.447447062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.447474957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.447515965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.447521925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.447562933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.447594881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.455984116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.456005096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.456083059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.456090927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.456177950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.472184896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.472256899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.472285986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.472294092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.472333908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.472357035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499032974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499111891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499144077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499154091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499211073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499346972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499387026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499416113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499424934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499454975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499476910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499797106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499835968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499865055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499871016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.499902964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.499928951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.500297070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.500365019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.500386953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.500406027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.500428915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.500448942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.536082983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.536106110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.536184072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.536192894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.536240101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.536349058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.536369085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.536421061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.536431074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.536497116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.536761999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.545084953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.545104980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.545191050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.545200109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.545238972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.561125040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.561147928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.561233997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.561249971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.561295033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.569227934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.569284916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.569314957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.569322109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.569372892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.569638014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.569706917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.569725990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.569781065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.578615904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.578656912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.578708887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.578715086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.578768969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.579045057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.579114914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.579116106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.579140902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.579166889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.579195976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.624947071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.625034094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.625065088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.625077009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.625133991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.625272036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.625312090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.625334024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.625344038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.625360966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.625391960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.633886099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.633905888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.633969069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.633976936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.634015083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.650501013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.650528908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.650577068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.650590897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.650605917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.650633097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.658099890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.658119917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.658176899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.658185959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.658231020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.658442974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.658462048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.658498049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.658504009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.658545017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.668340921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.668385029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.668427944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.668436050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.668493986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.668551922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.668617010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.668637991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.668698072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.713866949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.713916063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.713944912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.713953018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.713998079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.714519024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.714591980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.714601994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.714620113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.714648962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.714675903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.722799063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.722837925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.722887993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.722893953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.722949028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.739484072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.739506960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.739589930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.739600897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.739639044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.746953011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.746973038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.747066021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.747066975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.747077942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.747103930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.747131109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.747137070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.747175932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.747199059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.756871939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.756891966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.756974936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.756983042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.757030010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.757334948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.757361889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.757395983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.757407904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.757437944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.757458925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.807171106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.807221889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.807363987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.807393074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.807480097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.807746887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.807787895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.807815075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.807821035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.807864904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.811640024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.811681986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.811719894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.811727047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.811779022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.827934027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.827972889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.828002930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.828016043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.828032970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.828063011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.835717916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.835736036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.835817099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.835827112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.835872889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.837663889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.837682009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.837738991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.837747097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.837790966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.845496893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.845516920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.845593929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.845609903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.845652103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.846087933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.846112967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.846168995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.846177101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.846215010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.896075010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.896151066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.896370888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.896370888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.896384001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.896430969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.896533012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.896574974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.896599054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.896605968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.896641016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.896670103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.900295973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.900341988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.900409937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.900423050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.900471926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.900510073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.917045116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.917088032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.917170048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.917202950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.917331934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.917332888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.926081896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.926130056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.926179886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.926187992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.926246881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.926556110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.926609993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.926625967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.926631927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.926696062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.934539080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.934564114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.934637070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.934644938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.934690952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.935102940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.935121059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.935187101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.935194016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.935230970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.984759092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.984803915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.984841108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.984855890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.984894991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.984916925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.985263109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.985301971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.985332966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.985338926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.985378981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.989921093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.989960909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.990006924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:13.990015030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:13.990066051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.005723000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.005762100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.005820990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.005830050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.005877018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.014998913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.015039921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.015073061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.015080929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.015134096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.015420914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.015460014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.015485048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.015491009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.015533924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.023749113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.023785114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.023829937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.023838043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.023897886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.024149895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.024178028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.024209976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.024218082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.024247885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.024265051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.074011087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.074042082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.074081898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.074093103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.074152946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.074198008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.074218988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.074248075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.074254990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.074282885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.074307919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.078424931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.078485966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.078493118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.078509092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.078537941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.078563929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.094460011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.094487906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.094537020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.094547987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.094594955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.103705883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.103780031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.103801012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.103868961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.104114056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.104145050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.104182959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.104192019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.104212999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.104239941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.112436056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.112493038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.112539053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.112546921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.112596989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.112766981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.112788916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.112824917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.112833023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.112849951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.112876892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.162779093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.162810087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.162899971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.162920952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.162969112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.163258076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.163284063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.163330078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.163338900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.163358927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.163387060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.167083979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.167105913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.167176962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.167186022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.167228937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.183470011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.183501959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.183583975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.183593988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.183743954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.192348957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.192445993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.192528963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.192598104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.192934036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.192959070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.193000078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.193007946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.193031073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.193061113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.203960896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.204065084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.204066038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.204082966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.204226017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.204400063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.204421043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.204495907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.204504967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.204549074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.251703024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.251780987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.251806974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.251878023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.251883030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.251899958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.251920938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.251936913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.251966953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.251974106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.252034903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.255703926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.255728006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.255805016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.255814075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.255856991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.272437096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.272458076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.272521019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.272531033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.272552013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.272573948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.281303883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.281332970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.281366110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.281428099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.281435966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.281476021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.281745911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.281765938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.281816006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.281822920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.282110929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.292901039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.292995930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.293003082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.293018103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.293068886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.293271065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.293296099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.293329000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.293339014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.293363094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.293381929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.340188980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.340214014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.340327024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.340351105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.340401888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.340744019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.340765953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.340807915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.340821028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.340862989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.340883970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.345269918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.345290899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.345376968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.345395088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.345438957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.360682964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.360704899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.360810041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.360824108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.360881090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.370099068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.370124102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.370232105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.370244980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.370285988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.371185064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.371213913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.371346951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.371356964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.371407986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.381340981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.381361961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.381469965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.381480932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.381530046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.381803989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.381824970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.381902933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.381911039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.381956100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.432754993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.432775974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.432903051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.432934999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.432991028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.433615923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.433638096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.433733940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.433743000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.433798075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.436964035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.436984062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.437172890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.437185049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.437237024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.449465990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.449507952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.449568033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.449579954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.449616909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.449639082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.458587885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.458614111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.458689928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.458714962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.458740950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.458765984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.459743977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.459765911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.459842920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.459853888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.459892988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.470071077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.470093966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.470182896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.470194101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.470241070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.470388889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.470410109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.470463037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.470473051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.470513105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.521431923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.521459103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.521564007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.521603107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.521653891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.522018909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.522039890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.522089005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.522104025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.522133112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.522156000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.525650024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.525671959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.525856018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.525882959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.525929928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.538558960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.538604021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.538671017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.538691998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.538708925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.538734913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.547274113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.547293901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.547399044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.547424078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.547466993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.548316956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.548336983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.548413038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.548428059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.548470020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.558648109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.558670044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.558799982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.558821917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.558888912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.559072971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.559093952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.559146881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.559155941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.559195042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.611463070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.611485004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.611604929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.611630917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.611695051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.611901045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.611922026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.611977100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.611985922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.612031937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.614355087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.614382982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.614464045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.614473104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.614520073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.627177000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.627197981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.627252102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.627260923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.627320051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.637898922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.637954950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.638009071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.638017893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.638041019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.638073921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.638160944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.638215065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.638221979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.638233900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.638276100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.649190903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.649211884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.649296045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.649307013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.649358034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.649734020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.649754047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.649806023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.649813890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.649833918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.649858952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.700002909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.700087070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.700097084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.700122118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.700160027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.700176001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.700479984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.700515032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.700545073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.700555086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.700599909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.702940941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.702966928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.703027964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.703036070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.703079939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.716420889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.716445923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.716517925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.716526985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.716566086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.716597080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.726491928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.726516008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.726591110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.726618052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.726670027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.727164030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.727191925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.727236032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.727246046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.727293968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.727319956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.738287926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.738385916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.738403082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.738460064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.738481045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.738504887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.738533974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.738543034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.738570929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.738600016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.788623095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.788651943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.788804054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.788845062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.788887978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.789033890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.789058924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.789098024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.789105892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.789139986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.791754007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.791790009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.791824102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.791834116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.791862011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.791884899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.805172920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.805196047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.805273056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.805290937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.805318117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.805339098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.815006971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.815063953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.815141916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.815156937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.815196991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.816087008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.816114902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.816160917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.816169024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.816216946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.826858044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.826888084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.827013016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.827037096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.827083111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.827105999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.827142000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.827183008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.827189922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.827234983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.877579927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.877607107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.877667904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.877682924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.877718925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.877742052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.877865076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.877895117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.877927065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.877933979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.877976894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.880305052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.880327940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.880409002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.880417109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.880462885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.893845081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.893877029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.893934011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.893944979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.893979073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.894001007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.903814077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.903842926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.903944016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.903956890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.904005051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.904767990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.904798985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.904856920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.904865026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.904911995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.915344000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.915445089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.915446997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.915460110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.915498018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.915517092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.915724993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.915755033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.915796041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.915807962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.915838003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.915860891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.968406916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.968442917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.968502045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.968519926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.968552113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.968576908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.968647003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.968677998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.968724012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.968734026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.968770027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.971664906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.971687078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.971739054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.971748114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.971792936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.982566118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.982589006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.982630968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.982640982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.982692003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.992713928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.992738008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.992782116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.992793083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.992855072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.997622013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.997642994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.997692108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:14.997699976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:14.997750998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.004996061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.005088091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.005108118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.005194902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.005215883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.005244017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.005276918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.005285978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.005305052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.005330086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.057636976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.057662010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.057713032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.057724953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.057774067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.057992935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.058012962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.058052063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.058058977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.058079004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.058119059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.060703039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.060723066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.060761929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.060770035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.060816050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.075064898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.075093985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.075143099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.075153112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.075203896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.084186077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.084209919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.084253073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.084261894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.084310055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.086638927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.086662054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.086704016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.086711884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.086770058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.093604088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.093626976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.093672037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.093698025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.093718052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.093749046 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.093813896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.143955946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.143981934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.144032001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.144042969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.144088984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.144563913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.144588947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.144629002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.144638062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.144690990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.147150040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.147216082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.147255898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.147264957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.147319078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.161340952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.161364079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.161448002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.161464930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.161511898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.172964096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.173002005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.173032999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.173057079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.173089027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.173115015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.175290108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.175317049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.175362110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.175370932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.175421953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.181889057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.181915045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.181972027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.181979895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.182030916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.182394981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.182416916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.182456970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.182463884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.182519913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.232690096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.232712984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.232768059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.232779980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.232822895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.233179092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.233210087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.233270884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.233292103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.233313084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.233333111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.235621929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.235646009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.235699892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.235707998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.235754013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.249927044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.249948978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.250006914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.250024080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.250051022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.250073910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.262846947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.262871981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.262918949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.262928963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.262975931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.264236927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.264256001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.264336109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.264345884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.264389992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.270581007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.270612955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.270698071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.270706892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.270780087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.271316051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.271334887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.271397114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.271404028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.271446943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.323090076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.323182106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.323219061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.323273897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.323308945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.323337078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.323363066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.323374033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.323390961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.323414087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.325120926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.325143099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.325211048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.325217962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.325259924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.338789940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.338813066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.338871002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.338877916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.338932037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.352613926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.352644920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.352701902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.352708101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.352751970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.353538036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.353569031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.353609085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.353614092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.353657007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.361089945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.361114979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.361170053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.361176014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.361222029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.362463951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.362485886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.362535954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.362541914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.362581015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.411401987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.411425114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.411490917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.411499977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.411545038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.411582947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.411608934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.411633015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.411639929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.411659956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.411681890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.413861036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.413877964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.413928986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.413935900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.413989067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.431456089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.431474924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.431530952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.431539059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.431581020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.450119972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.450151920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.450187922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.450193882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.450246096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.450397968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.450424910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.450452089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.450459003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.450483084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.450505018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.455368996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.455394983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.455427885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.455434084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.455471992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.455852032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.455888033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.455910921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.455916882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.455956936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.500044107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.500066996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.500144958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.500159979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.500195980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.500361919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.500386000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.500467062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.500473976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.500503063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.502260923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.502281904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.502314091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.502321005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.502342939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.502374887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.521888971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.521912098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.521958113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.521970034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.522013903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.539122105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.539154053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.539191008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.539202929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.539254904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.539575100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.539593935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.539630890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.539638042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.539684057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.544007063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.544030905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.544066906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.544074059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.544111013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.544262886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.544282913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.544315100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.544321060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.544344902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.544368029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.589232922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589257956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589345932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.589365005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589473009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589479923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.589488029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589504957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589637995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.589637995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.589648008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.589694023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.590998888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.591017962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.591063023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.591074944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.591123104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.610479116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.610502958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.610544920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.610555887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.610574961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.610596895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.627460003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.627489090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.627516985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.627523899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.627597094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.627804995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.627823114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.627865076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.627876043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.627908945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.632770061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.632788897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.632832050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.632849932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.632860899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.632883072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.633066893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.633085012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.633109093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.633115053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.633140087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.633164883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.679128885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.679146051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.679198980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.679213047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.679250956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.679383039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.679400921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.679552078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.679560900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.679605961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.681180000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.681195974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.681252956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.681261063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.681297064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.699055910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.699070930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.699131966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.699156046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.699167013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.699188948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.717212915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.717243910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.717277050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.717288971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.717308998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.717328072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.717520952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.717540026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.717566967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.717572927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.717596054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.717611074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.722727060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.722754955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.722800016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.722809076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.722835064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.722861052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.723058939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.723077059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.723190069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.723196030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.723238945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.767868996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.767895937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.767950058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.767963886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.767997026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.768062115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.768079996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.768116951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.768124104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.768146992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.768172979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.769912004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.769933939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.769984007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.769989967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.770025969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.787946939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.787975073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.788023949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.788033962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.788067102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.788081884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.805877924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.805905104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.805972099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.805982113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.806011915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.806035042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.806210995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.806236029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.806288004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.806294918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.806322098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.806335926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.811355114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.811373949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.811441898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.811450005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.811494112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.811769009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.811800003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.811830044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.811837912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.811860085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.811886072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.856591940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.856633902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.856704950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.856720924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.856741905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.856760979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.856887102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.856904984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.856940985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.856946945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.856972933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.856980085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.858544111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.858561039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.858614922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.858620882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.858654022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.858673096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.876554012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.876573086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.876653910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.876667023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.876787901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.894622087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.894650936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.894711018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.894721031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.894764900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.894884109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.894902945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.894927025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.894936085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.894973993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.894988060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.900024891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.900054932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.900089979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.900096893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.900124073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.900139093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.900461912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.900490999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.900527954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.900537014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.900559902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.900577068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.945377111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.945398092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.945460081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.945471048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.945516109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.945727110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.945744038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.945780993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.945786953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.945818901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.947041988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.947065115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.947110891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.947118044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.947145939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.965207100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.965229034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.965358019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.965395927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.966481924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.983143091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.983160973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.983216047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.983223915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.983243942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.983263016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.983722925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.983740091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.983782053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.983788013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.983812094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.988682032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.988698959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.988738060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.988744974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.988778114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.989105940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.989120960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.989156008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.989161968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:15.989175081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:15.989196062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.034184933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.034221888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.034260988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.034272909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.034311056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.034456015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.034472942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.034507990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.034513950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.034527063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.034543037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.036277056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.036308050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.036365032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.036370993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.036407948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.053848028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.053867102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.053908110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.053915977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.053941011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.072048903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.072082996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.072134018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.072140932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.072180986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.072374105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.072388887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.072418928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.072423935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.072434902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.072449923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.077200890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.077217102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.077267885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.077275038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.077312946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.077677965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.077697039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.077725887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.077732086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.077749968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.077766895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.123630047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.123647928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.123698950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.123711109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.123747110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.124174118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.124197006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.124283075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.124283075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.124290943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.124320984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.125639915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.125657082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.125799894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.125808954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.125837088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.142565966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.142591000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.142684937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.142684937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.142693043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.142785072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.160998106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.161019087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.161087036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.161103010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.161210060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.161241055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.161253929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.161258936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.161307096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.161307096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.165891886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.165918112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.165960073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.165966034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.165983915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.166026115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.166400909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.166433096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.166455030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.166460991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.166481018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.167386055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.212646008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.212675095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.212718010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.212724924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.212779045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.212946892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.212973118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.212996960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.213002920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.213047981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.213047981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.214142084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.214162111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.214215994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.214215994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.214222908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.214248896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.231751919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.231784105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.231874943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.231887102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.233546972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.249768019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.249789953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.249917984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.249943972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.250144958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.250185966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.250196934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.250205040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.251878977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.255285978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.255305052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.255405903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.255419970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.255944014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.255960941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.256030083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.256030083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.256038904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.256068945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.301182032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.301214933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.301317930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.301317930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.301338911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.301373959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.301491976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.301508904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.301537037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.301544905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.301567078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.301656961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.302732944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.302748919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.302774906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.302786112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.302810907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.305335045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.323544025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.323575020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.323657036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.323657036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.323687077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.323719978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.338556051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.338584900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.338664055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.338664055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.338680029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.338710070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.338987112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.339013100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.339037895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.339046001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.339061975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.339293957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.344111919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.344153881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.344182968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.344197035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.344219923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.344245911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.344748974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.344765902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.344819069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.344825983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.344841003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.344984055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.390121937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.390147924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.390207052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.390225887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.390464067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.390494108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.390522003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.390532017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.390546083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.390619040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.392842054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.392864943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.392894030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.392903090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.392920971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.392956018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.412758112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.412790060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.412866116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.412883043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.412909985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.413563013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.427464008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.427488089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.427521944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.427536011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.427562952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.427581072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.428658009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.428682089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.428723097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.428733110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.428757906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.428829908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.433332920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.433357954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.433399916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.433409929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.433538914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.434195042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.434215069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.434288025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.434288025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.434298992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.434333086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.478805065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.478825092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.479027987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.479042053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.481504917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.482630968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.482650042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.482683897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.482693911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.482712984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.482800007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.483668089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.483685017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.483767033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.483767986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.483777046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.483819962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.515816927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.515835047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.515911102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.515922070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.516323090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.516963005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.516987085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.517066002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.517066002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.517076015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.517123938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.521692038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.521711111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.521795988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.521795988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.521806955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.521836996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.522098064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.522121906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.522171021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.522178888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.522200108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.522263050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.567519903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.567545891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.567698956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.567717075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.567750931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.567781925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.567805052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.567811966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.567830086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.567864895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.571101904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.571125031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.571199894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.571208954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.572171926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.572566986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.572594881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.572626114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.572635889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.572653055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.572669983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.604470968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.604507923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.604552984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.604566097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.604594946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.604625940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.605531931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.605549097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.605747938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.605757952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.606107950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.610704899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.610722065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.610929966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.610939980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.610987902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.611087084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.611109972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.611135006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.611141920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.611169100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.611239910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.656889915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.656927109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.656959057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.656980991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.656996012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.657021999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.657066107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.657095909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.657130003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.657139063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.657164097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.657179117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.660377026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.660396099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.660475969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.660475969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.660491943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.660573959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.662240028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.662264109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.662288904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.662297964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.662312031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.662328959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.693304062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.693331957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.693543911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.693563938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.693604946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.694190979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.694210052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.694310904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.694320917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.694355011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.699677944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.699702024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.699868917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.699881077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.700089931 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.700093031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.700104952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.700138092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.700145960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.700170040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.700175047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.700196981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.700331926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.745471954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745497942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745569944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.745569944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.745585918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745712996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745712996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.745728016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745754004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745779991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.745789051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.745826006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.745826006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.748615980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.748636961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.748677969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.748684883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.748712063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.748747110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.750452995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.750480890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.750505924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.750513077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.750533104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.750551939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.781970978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.782002926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.782051086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.782069921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.782088995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.782105923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.782845020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.782864094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.782927990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.782927990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.782939911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.782974005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.788590908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.788613081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.788682938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.788682938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.788695097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.788726091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.789061069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.789083958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.789151907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.789151907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.789163113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.789201021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.833847046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.833878994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.833918095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.833935976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.833951950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.834007978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.834106922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.834121943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.834141970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.834208965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.834217072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.834249020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.837440014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.837464094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.837503910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.837510109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.837536097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.837563038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.839272022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.839298010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.839323044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.839340925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.839349031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.839375019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.870639086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.870660067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.870731115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.870743990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.870759010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.870888948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.871762037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.871778965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.871819019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.871824980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.871859074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.877279043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.877310991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.877334118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.877341032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.877367020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.877583981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.877604961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.877605915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.877628088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.877630949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.877652884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.877693892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.922770023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.922808886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.922893047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.922893047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.922914028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.922955990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.922976971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.922979116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.922990084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.923001051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.923051119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.926084995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.926100016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.926290989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.926299095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.926333904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.927985907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.928004026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.928452015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.928461075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.928498030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.959348917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.959369898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.959419966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.959430933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.959470034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.960781097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.960799932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.960854053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.960870028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.960906029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.967833042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.967852116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.967928886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.967945099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.967979908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.968149900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.968167067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.968199015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.968205929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:16.968228102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:16.968337059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.012263060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.012289047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.012347937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.012361050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.012399912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.012630939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.012653112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.012676001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.012684107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.012708902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.013071060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.015703917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.015721083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.015784025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.015789986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.015824080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.018405914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.018424988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.018543005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.018543005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.018551111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.018584967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.048254013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.048276901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.048333883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.048346996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.048408031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.049393892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.049417019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.049464941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.049472094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.049503088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.054569960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.054593086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.054617882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.054625034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.054655075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.055566072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.055582047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.055630922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.055638075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.055722952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.102142096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.102168083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.102236986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.102257013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.102277994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.102294922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.102509022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.102535963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.102566004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.102571964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.102596998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.102623940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.106276989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.106306076 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.106353998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.106360912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.106411934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.109420061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.109441996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.109494925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.109503031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.109555006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.136775017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.136801004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.136898041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.136912107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.136962891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.138009071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.138030052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.138075113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.138083935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.138122082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.143259048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.143277884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.143330097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.143338919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.143369913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.143385887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.144301891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.144318104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.144361973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.144368887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.144398928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.193950891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.193977118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194019079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.194031000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194058895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.194073915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.194366932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194386959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194432974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.194442034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194478989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.194818974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194839954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194886923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.194894075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.194926977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.198452950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.198471069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.198513985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.198519945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.198553085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.225519896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.225539923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.225581884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.225590944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.225636959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.226757050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.226773977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.226833105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.226850033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.226883888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.232202053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.232224941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.232247114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.232253075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.232290983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.233628035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.233644962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.233678102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.233685017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.233720064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.282418013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.282438993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.282480001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.282490015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.282525063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.282658100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.282680035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.282706022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.282721043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.282737017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.282753944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.283297062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.283313990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.283356905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.283363104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.283395052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.286838055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.286870956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.286895990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.286900997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.286946058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.320734978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.320759058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.320806026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.320827007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.320857048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.320873976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.321161985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.321177959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.321203947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.321239948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.321247101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.321280003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.321496964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.321513891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.321549892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.321557999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.321578026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.321597099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.322815895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.322832108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.322885990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.322895050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.322936058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.371182919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371200085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371268988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.371280909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371323109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.371516943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371536016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371584892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.371592999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371630907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.371934891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371952057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.371988058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.371994972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.372010946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.372034073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.375545979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.375565052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.375607014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.375613928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.375663042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.403745890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.403772116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.403809071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.403817892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.403846025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.403871059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.410125017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.410144091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.410191059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.410197973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.410234928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.410471916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.410496950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.410520077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.410530090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.410571098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.411727905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.411745071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.411784887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.411792040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.411827087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.411844015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.459981918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460007906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460056067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460067034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460081100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460130930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460216999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460261106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460294008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460299969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460320950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460339069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460566044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460587978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460654974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460660934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.460743904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.460743904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.464278936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.464294910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.464332104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.464339018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.464375973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.464392900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.492317915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.492351055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.492368937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.492419004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.492427111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.492474079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.498893976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.498945951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.498946905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.498979092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.498986959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.499017000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.499041080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.499211073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.499237061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.499260902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.499274015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.499300003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.499317884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.500464916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.500531912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.500545979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.500598907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.548489094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.548515081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.548579931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.548590899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.548619986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.548633099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.548727036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.548751116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.548779964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.548785925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.548803091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.548825026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.549235106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.549280882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.549293041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.549299002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.549331903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.552962065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.552988052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.553040028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.553050041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.553080082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.553095102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.583312988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.583353043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.583399057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.583420992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.583436012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.583463907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.589792967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.589823961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.589864016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.589873075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.589920044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.590251923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.590274096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.590317011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.590325117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.590337038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.590362072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.591684103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.591706038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.591737032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.591747046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.591780901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.591797113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.639954090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.639986992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.640089989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.640104055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.640152931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.640172005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.640203953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.640238047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.640245914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.640265942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.640280962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.642509937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.642534018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.642613888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.642622948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.642668009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.645160913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.645194054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.645258904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.645270109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.645288944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.645303965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.669918060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.669953108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.670059919 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.670078039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.670123100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.676228046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.676255941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.676338911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.676348925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.676393032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.676493883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.676523924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.676585913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.676593065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.676625013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.676625967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.677572012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.677598953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.677654028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.677661896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.677683115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.677702904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737287998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737314939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737462044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737483025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737535000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737620115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737643003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737670898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737678051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737704992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737747908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737776995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737797022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737823963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737831116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.737879992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.737879992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.738171101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.738193035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.738223076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.738234997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.738257885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.738279104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.758655071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.758718967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.758781910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.758793116 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.758820057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.758836031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.765141010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.765166998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.765233994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.765247107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.765285969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.765547037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.765568972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.765618086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.765625000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.765641928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.765664101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.766294003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.766321898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.766376972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.766386032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.769735098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.821016073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821059942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821154118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.821172953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821218967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.821464062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821485996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821542025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.821549892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821870089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821902037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821943998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.821949959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.821964025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.821990967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.822276115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.822299004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.822465897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.822501898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.822849035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.847208023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.847239971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.847347975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.847369909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.847870111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.853645086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.853666067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.853816986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.853827953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.853988886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.854017973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.854059935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.854068041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.854096889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.854121923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.855727911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.855755091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.855809927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.855818987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.855842113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.855864048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910026073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910084009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910141945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910192966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910204887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910216093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910233974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910234928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910271883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910281897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910319090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910363913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910814047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910844088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910880089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910887003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.910897017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.910926104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.936753035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.936778069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.936892986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.936911106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.937936068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.942229033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.942251921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.942306995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.942316055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.942339897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.942358971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.942759037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.942781925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.942876101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.942884922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.942924023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.942924976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.944468975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.944539070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.944554090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.944605112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.999708891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.999735117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.999798059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.999828100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:17.999846935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:17.999864101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.000570059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.000597000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.000648022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.000654936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.000679016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.000705004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.000901937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.000926018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.000972033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.000979900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.000999928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.001023054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.001848936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.001880884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.001934052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.001943111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.001976013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.002002954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.025171995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.025201082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.025263071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.025276899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.025316000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.025450945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.031045914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.031073093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.031111002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.031121016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.031146049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.031162024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.031219006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.031239986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.031269073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.031276941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.031299114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.031317949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.033303022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.033329964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.033410072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.033421040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.033454895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.033462048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.096385002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.096412897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.096455097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.096472025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.096498966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.096527100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.097893953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.097923040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.097975969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.097985983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098040104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.098223925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098244905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098284006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.098292112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098311901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.098330975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.098592997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098615885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098661900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.098671913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.098699093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.098717928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.113799095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.113822937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.113871098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.113893986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.113959074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.113960028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.119453907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.119489908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.119539022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.119548082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.119607925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.119607925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.119806051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.119828939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.119961977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.119961977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.119970083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.120095968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.121951103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.121975899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.122010946 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.122025967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.122047901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.122080088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.185177088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.185287952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.185370922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.185432911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188046932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188076019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188235044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188261986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188277006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188317060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188328981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188410997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188410997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188417912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188565969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188720942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188740969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188771963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188781977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.188803911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.188894033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.202617884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.202719927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.202831030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.202914000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.208192110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.208214045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.208270073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.208281040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.208307981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.208332062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.208606005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.208643913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.208667040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.208677053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.208698988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.208744049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.210587025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.210608006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.210649014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.210658073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:18.210679054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:18.210706949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.249309063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249322891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249368906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249386072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.249392986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249432087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.249490976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249512911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249541998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.249547005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.249562025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.249579906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.249983072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250001907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250034094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250039101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250070095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250163078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250183105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250214100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250220060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250243902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250260115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250494003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250514030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250544071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250549078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250576973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250586987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250601053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250627995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250637054 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250650883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.250670910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.250688076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251250029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251267910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251297951 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251302958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251336098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251652956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251672983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251701117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251707077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251727104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251739025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251771927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251791000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251821995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251827955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.251852036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.251868963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252477884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252510071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252533913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252540112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252563000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252578974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252600908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252623081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252650023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252655029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252677917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252693892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252710104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252729893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252758026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252763033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.252787113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.252804041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253375053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253393888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253423929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253429890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253453016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253468990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253514051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253532887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253561974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253566980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253590107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253592968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253612041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253619909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253633022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.253642082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.253678083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.254494905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.254513025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.254542112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.254549026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.254580021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.254616976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255243063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255268097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255317926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255323887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255346060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255362034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255363941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255376101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255403996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255409002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255430937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255434990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255458117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255466938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255486012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255482912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255502939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.255517960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.255551100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256416082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256448984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256474018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256486893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256501913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256515980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256534100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256553888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256580114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256586075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256596088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256608009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256623983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256634951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256649971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256649971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.256680965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.256704092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257246971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257271051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257297993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257303953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257319927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257333994 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257359982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257380009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257415056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257420063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257445097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257460117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257488966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257508039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257539034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257544994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.257571936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.257590055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258084059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258106947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258135080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258141041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258166075 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258177996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258240938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258260012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258286953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258292913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258306026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258315086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258332014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258344889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258358002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258358955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258393049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258444071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258465052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258490086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258495092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.258507967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.258526087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259094000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259128094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259151936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259157896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259179115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259192944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259193897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259212971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259238005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259239912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259263992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259268999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259290934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259315014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259344101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259363890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259390116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259394884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.259417057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.259433031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260052919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260080099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260107040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260113001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260134935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260142088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260149956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260154963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260171890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260186911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260215998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260221004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260235071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260248899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260257006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260270119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260277033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260307074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260310888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260339022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260390997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260411024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260437965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260442972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.260467052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.260492086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.261010885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.261034966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.261068106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.261074066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.261123896 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.261147976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.261240959 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.261245012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.261285067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262198925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262221098 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262247086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262253046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262269974 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262285948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262531996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262552977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262578964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262583971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262605906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262622118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262768030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262789965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262814045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262820005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.262840986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262857914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.262990952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263011932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263036013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263041019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263072968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263087988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263350964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263372898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263396978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263401985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263426065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263439894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263477087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263504982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263528109 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263533115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263556004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263571024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.263957977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.263986111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264008045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264014006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264027119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264261961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264287949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264291048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264307976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264317989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264341116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264365911 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264429092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264461040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264493942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264499903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264508963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264530897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264930964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264960051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.264985085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.264991045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265014887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265033007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265333891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265353918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265378952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265383959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265400887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265410900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265425920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265427113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265445948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265453100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265494108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265518904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265547991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265563965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265577078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265588045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265605927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265607119 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265620947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265644073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265655041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265661001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.265685081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.265698910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266100883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266124010 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266149044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266155005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266180992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266196966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266360998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266383886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266422987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266427040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266446114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266462088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266534090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266555071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266580105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266586065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266613007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266621113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266635895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266648054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266664028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.266668081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.266704082 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267370939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267402887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267430067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267436028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267462969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267472029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267477989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267486095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267509937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267517090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267525911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267544031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267560005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267623901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267649889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267673016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267678976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.267699957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.267715931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268167973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268188953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268218040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268224001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268249035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268264055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268296957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268320084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268345118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268349886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268373013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268388033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268449068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268469095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268493891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268500090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268521070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268537045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268671989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268706083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268714905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268721104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268750906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268765926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268786907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268810034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268815994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.268834114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.268850088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.269417048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269442081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269526958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269555092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269610882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269629955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269772053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.269782066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.269813061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270174026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270212889 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270237923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270242929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270267963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270283937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270314932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270338058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270359993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270365000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270390034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270406008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270463943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270493031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270514011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270519972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270541906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270559072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270582914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270615101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270637035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270642042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.270664930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.270680904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271051884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271106005 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271106958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271120071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271153927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271212101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271234989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271260977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271266937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271289110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271306038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271327019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271348000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271369934 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271374941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271397114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271411896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271416903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271430016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271455050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271462917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271471024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.271490097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.271508932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274261951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274282932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274333000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274339914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274369001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274391890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274415016 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274437904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274442911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274462938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274478912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274619102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274640083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274661064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274667978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274691105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274707079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274712086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274724960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274753094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274760008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274766922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274785995 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274805069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274864912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274892092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274924040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274929047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.274949074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.274976015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.275125027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.275168896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.295074940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.295083046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.295094013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.295104980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.295402050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.295408964 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.295423985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.295517921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328001022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328032017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328058004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328064919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328115940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328231096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328264952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328279972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328286886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328306913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328325987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328538895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328577042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328589916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328596115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328627110 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328875065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328896046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328922033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328927994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.328943968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.328958988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.329004049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.329049110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.329056978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.329068899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.329096079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.329108953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.341607094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.341630936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.341662884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.341669083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.341711998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.341886997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.341913939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.341939926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.341944933 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.341962099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.341979980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.342107058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.342128992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.342154980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.342159986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.342183113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.342197895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.414309025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.414338112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.414367914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.414376020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.414423943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.414683104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417078018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417104959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417136908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417141914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417181015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417342901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417370081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417392015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417398930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417435884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417591095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417625904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417649031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417655945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417685986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417701960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417870998 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417893887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417917967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.417922974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.417953968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.422080040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430417061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430444956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430480957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430486917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430550098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430587053 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430628061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430644989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430651903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430672884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430691004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430911064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430934906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430959940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.430965900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.430991888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.431008101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.432420015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.438429117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.503098965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.503124952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.503149986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.503190041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.503197908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.503231049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.505650997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.505671024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.505697966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.505707979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.505729914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.505748987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.505904913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.505924940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.505949020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.505954027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.505979061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.505995035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.506351948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.506371021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.506397009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.506402969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.506427050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.506443024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.506668091 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.506688118 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.506716967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.506721973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.506747007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.506762981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519171953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519192934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519229889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519236088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519253969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519279003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519407988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519428968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519450903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519455910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519471884 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519490957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519722939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519766092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519793987 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519798994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.519814014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.519833088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.591860056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.591883898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.591919899 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.591928005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.591957092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.591974020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.594400883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.594424009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.594451904 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.594458103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.594475031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.594496012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.594748974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.594769001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.594795942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.594801903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.594819069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.594834089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.595288038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.595314026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.595339060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.595344067 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.595361948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.595379114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.597168922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.597189903 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.597217083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.597228050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.597240925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.597261906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.612401009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.612420082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.612464905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.612471104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.612508059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.612714052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.612735033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.612757921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.612763882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.612782955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.612802029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.613044977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.613065958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.613090992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.613095999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.613121986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.613137960 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.682179928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.682200909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.682256937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.682271957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.682300091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.682322979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.683634043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.683664083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.683736086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.683742046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.683787107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.683917046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.683937073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.683973074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.683979034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.684011936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.684745073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.684770107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.684814930 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.684822083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.684838057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.684859991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.685026884 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.685048103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.685076952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.685082912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.685113907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.697273970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.697297096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.697355986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.697361946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.697403908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.697714090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.697740078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.697761059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.697767019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.697792053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.697812080 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.698442936 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.698467970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.698502064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.698508024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.698524952 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.698544025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.771028042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.771065950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.771095037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.771107912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.771120071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.771145105 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.772754908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.772782087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.772811890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.772819996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.772838116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.772855997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.773212910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.773235083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.773262978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.773268938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.773283958 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.773302078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.773658991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.773682117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.773715973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.773720980 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.773729086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.773753881 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.774432898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.774471045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.774516106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.774516106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.774523973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.774554968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.785782099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.785804033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.785839081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.785847902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.785872936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.785891056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.785998106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.786022902 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.786047935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.786052942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.786077976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.786097050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.787132025 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.787161112 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.787192106 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.787197113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.787216902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.787236929 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.859838009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.859862089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.859910011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.859921932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.859935045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.859968901 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.861311913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.861340046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.861367941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.861372948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.861388922 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.861404896 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.861569881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.861594915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.861627102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.861633062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.861658096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.861679077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.862405062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.862425089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.862451077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.862456083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.862482071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.862503052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.863172054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.863203049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.863228083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.863234043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.863256931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.863275051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.874530077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.874573946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.874613047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.874619007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.874655008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.874716043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.874739885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.874774933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.874779940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.874799013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.874815941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.875803947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.875834942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.875874996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.875880957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.875915051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.948440075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.948524952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.948576927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.948596954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.948662043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.949949026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.949970007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.950038910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.950047970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.950082064 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.950180054 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.950205088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.950242996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.950248957 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.950258970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.951047897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.951066971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.951070070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.951086044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.951102972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.951143026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.951627970 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.951643944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.951699018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.951706886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.951749086 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.963105917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.963134050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.963172913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.963181019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.963206053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.963229895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.963356018 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.963371992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.963397980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.963406086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.963434935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.963444948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.964270115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.964289904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.964329004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.964334965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:19.964351892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:19.964375973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.037193060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.037220955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.037305117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.037318945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.037379026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.038765907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.038794994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.038834095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.038841009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.038885117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.038940907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.038959026 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.038995981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.039001942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.039011002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.039038897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.039668083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.039693117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.039738894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.039745092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.039779902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.040229082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.040256023 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.040294886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.040301085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.040327072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.040350914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.054598093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.054624081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.054670095 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.054681063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.054713964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.054733038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.055197954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.055214882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.055258989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.055272102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.055294037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.055315018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.057996988 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.058017015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.058062077 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.058068991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.058089972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.058119059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.126087904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.126110077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.126178026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.126187086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.126231909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.126231909 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.127943993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.127965927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128042936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128048897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128112078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128285885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128309965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128336906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128351927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128366947 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128398895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128685951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128704071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128766060 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128772020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128808022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128808022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.128968000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.128984928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.129014015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.129019976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.129045963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.129089117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.143501043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.143517971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.143578053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.143584967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.143610001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.143666029 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.143887997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.143903971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.143970966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.143978119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.143994093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.144077063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.146992922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.147012949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.147099018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.147099018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.147104979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.147187948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.214431047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.214457035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.214534044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.214534044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.214565992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.214627981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.216209888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.216242075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.216315031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.216315031 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.216325045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.216597080 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.216624975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.216660976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.216667891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.216686010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.216876984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.217132092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.217152119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.217202902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.217217922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.217232943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.217351913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.217593908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.217617035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.217685938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.217685938 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.217691898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.217756033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.232533932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.232575893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.232628107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.232631922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.232646942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.232661963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.232666969 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.232707024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.232707024 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.232718945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.233055115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.236033916 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.236057997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.236119032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.236126900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.236341953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.303217888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.303241014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.303325891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.303325891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.303338051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.303708076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305021048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305038929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305099010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305107117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305238962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305344105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305372953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305430889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305430889 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305438042 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305541992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305824995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305844069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.305984020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.305990934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.306219101 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.306541920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.306562901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.306768894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.306768894 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.306776047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.306917906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.321544886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.321595907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.321650982 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.321677923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.321677923 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.321688890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.321743011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.321743011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.324781895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.324805021 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.324939966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.324939966 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.324947119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.324985027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.391834974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.391858101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.392004013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.392019033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.392179012 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395220041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395241976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395421982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395421982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395442009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395474911 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395484924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395492077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395519972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395528078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395579100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395579100 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.395584106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.395808935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.396462917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.396492958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.396516085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.396531105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.396559954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.396754026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.396863937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.396889925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.397025108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.397025108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.397031069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.397124052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.410101891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.410126925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.410229921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.410229921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.410242081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.410320044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.410336971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.410350084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.410367966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.410394907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.410437107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.413109064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.413136959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.413167000 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.413187981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.413204908 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.413269043 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.480592012 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.480618954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.480726004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.480726004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.480740070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.480773926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.482742071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.482759953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.482897043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.482918978 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.482927084 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.482953072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.483170033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.484857082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.484878063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.484942913 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.484950066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.485001087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.485126019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.485141039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.485193968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.485198975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.485232115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.498771906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.498795986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.498833895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.498840094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.499001026 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.499036074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.499051094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.499114990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.499114990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.499121904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.499957085 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.501686096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.501705885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.501728058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.501779079 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.501791954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.501831055 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.569257975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.569283962 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.569400072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.569400072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.569411993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.570622921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.571552992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.571572065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.571624041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.571631908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.571798086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.571820021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.571825981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.571887016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.571887016 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.573538065 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.573555946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.573767900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.573828936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.573828936 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.573836088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.573962927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.587502003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.587538004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.587618113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.587764025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.587764025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.587774992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.587934017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.591128111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.591156006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.591223955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.591231108 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.591634035 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.658611059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.658636093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.658798933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.658813000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.659109116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.660339117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.660358906 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.660413027 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.660419941 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.660434961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.660465002 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.660470963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.660526991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.660526991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.662529945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.662554979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.662596941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.662605047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.662636042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.662636042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.663194895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.663213015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.663263083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.663269043 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.663645983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.676407099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.676435947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.676542044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.676634073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.676634073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.676642895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.678680897 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.679812908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.679847956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.679881096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.679887056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.679918051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.679918051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.748792887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.748820066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.748912096 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.748925924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749110937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749138117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.749144077 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749156952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749181986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.749217987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749233007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749259949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.749269009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.749295950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.749295950 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.750044107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.754888058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.754915953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.754961967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.754968882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.755213022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.755237103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.755237103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.755242109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.755256891 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.755340099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.755431890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.764933109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.764952898 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.765050888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.765072107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.767477036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.767503977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.767844915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.767853975 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.767973900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.768363953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.768381119 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.768511057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.768522978 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.768902063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.837920904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.837955952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.838033915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.838043928 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.838067055 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.838092089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.838284969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.838347912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.838368893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.838418007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.838428020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.838438988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.839711905 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.842078924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.842097044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.842341900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.842341900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.842353106 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.842523098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.842633963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.842662096 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.842729092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.842729092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.842736006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.842798948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.853687048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.853719950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.853782892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.853782892 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.853790045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.855926037 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.855948925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.855957031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.855972052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.855994940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.856367111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.856997967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.857012033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.857064009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.857070923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.857096910 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.857112885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.926651001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.926702976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.926781893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.926800966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.926862001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.926927090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.926959038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.926990032 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.926995993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.927047014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.927222967 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.927249908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.927273989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.927282095 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.927297115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.927392006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.927392006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.930970907 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.930999041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.931040049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.931046009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.931061983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.931118965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.932132959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.932159901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.932198048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.932204008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.932248116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.932248116 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.942538977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.942567110 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.942713976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.942720890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.942822933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.944987059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.945025921 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.945092916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.945092916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.945100069 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.945336103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.945772886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.945801973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.945833921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.945842028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:20.945866108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:20.945897102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015171051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015202045 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015290976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015299082 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015448093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015597105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015619040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015656948 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015662909 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015676975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015712976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015842915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015866041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015897989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.015909910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.015942097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.016002893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.019685984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.019716024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.019771099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.019777060 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.019818068 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.019829988 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.020622015 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.020643950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.020677090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.020683050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.020734072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.020734072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.031809092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.031836033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.031888962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.031894922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.031943083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.031943083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.034111977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.034137011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.034190893 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.034197092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.034245968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.034900904 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.034924984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.034961939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.034967899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.035011053 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.103643894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.103672981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.103729010 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.103739977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.103833914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.103833914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.104489088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.104516983 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.104566097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.104573965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.104593992 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.104597092 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.104624033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.104648113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.104655027 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.104667902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.104727030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.104727030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.108292103 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.108310938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.108397961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.108397961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.108413935 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.108726025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.109348059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.109390020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.109416962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.109424114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.109451056 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.109457970 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.119853020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.119880915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.119936943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.119945049 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.119966030 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.119992018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.122520924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.122543097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.122642040 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.122648954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.122697115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.123517036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.123534918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.123578072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.123584986 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.123609066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.123631001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194006920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194030046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194084883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194096088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194117069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194139004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194592953 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194611073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194639921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194645882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194674969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194693089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194906950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194947958 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.194976091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.194983959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.195004940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.195029020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.198334932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.198373079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.198410034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.198416948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.198434114 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.198453903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.199417114 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.199435949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.199475050 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.199480057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.199496984 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.199521065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.208745003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.208770990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.208842039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.208851099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.208889961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.211476088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.211500883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.211544991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.211550951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.211590052 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.211895943 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.212153912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.212179899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.212213039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.212219954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.212251902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.212265968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.283759117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.283826113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.283849955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.283863068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.283890963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.283915997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.284023046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.284080029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.284111023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.284117937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.284157038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.285027981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.285109997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.285118103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.285140038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.285167933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.285201073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.287262917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.287334919 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.287341118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.287375927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.287393093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.287421942 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.288559914 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.288619041 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.288634062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.288644075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.288677931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.288703918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.297735929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.297789097 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.297836065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.297842979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.297888041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.300163984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.300234079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.300260067 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.300266981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.300295115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.300323009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.300944090 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.301038980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.301040888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.301098108 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.301115990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.301160097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372281075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372344971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372402906 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372415066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372448921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372478962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372571945 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372621059 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372647047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372653961 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372709036 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372895956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.372966051 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.372987032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.373054028 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.378576994 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.378645897 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.378681898 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.378690004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.378720999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.378746986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.378813028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.378879070 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.378892899 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.378957033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.387331963 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.387392044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.387439013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.387445927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.387495041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.388700008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.388761997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.388813019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.388820887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.388845921 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.388869047 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.389659882 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.389735937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.389755011 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.389764071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.389797926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.389817953 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.462721109 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.462773085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.462805033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.462832928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.462848902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.462897062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.463061094 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.463103056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.463129997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.463139057 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.463175058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.463198900 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.463327885 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.463371038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.463397980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.463404894 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.463432074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.463464975 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.466553926 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.466598034 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.466639996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.466648102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.466694117 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.467561960 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.467612028 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.467638969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.467648029 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.467669964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.467698097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.476319075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.476397038 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.476418972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.476504087 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.479159117 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.479202032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.479266882 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.479288101 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.479332924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.480160952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.480221033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.480274916 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.480283976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.480319977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.480350018 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.549933910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550003052 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550101042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550143003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550168037 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550184965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550476074 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550518036 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550551891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550564051 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550609112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550631046 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550677061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550704956 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550713062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.550746918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.550770044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.553684950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.553730011 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.553771019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.553785086 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.553811073 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.553836107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.554363966 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.554408073 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.554434061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.554450035 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.554476023 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.554497957 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.563647032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.563721895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.563747883 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.563769102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.563800097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.563827991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.566169977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.566214085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.566251993 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.566278934 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.566298008 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.566322088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.567101955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.567143917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.567176104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.567187071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.567219973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.567245007 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.638451099 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638475895 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638559103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.638586044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638632059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.638725996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638751030 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638778925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.638787031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638828039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.638936996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638953924 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.638992071 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.638998985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.639020920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.639045954 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.642580032 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.642604113 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.642710924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.642719984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.642765045 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.642932892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.642949104 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.642999887 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.643007040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.643064976 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.652537107 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.652560949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.652607918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.652616024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.652647972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.652671099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.654614925 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.654629946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.654700041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.654711008 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.654748917 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.656055927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.656084061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.656116962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.656126976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.656156063 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.656177998 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727020979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727051973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727104902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727125883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727144003 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727165937 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727226019 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727243900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727289915 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727299929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727338076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727735996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727773905 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727793932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727807999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.727826118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.727850914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.731198072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.731215954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.731281996 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.731298923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.731339931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.731585979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.731601954 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.731652021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.731662989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.731697083 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.742131948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.742150068 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.742214918 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.742239952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.742280006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.745166063 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.745198965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.745238066 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.745250940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.745266914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.745285034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.745729923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.745776892 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.745798111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.745806932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.745824099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.745847940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.815871000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.815901995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816024065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.816075087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816111088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816132069 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.816135883 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816154003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816191912 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.816230059 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.816540003 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816565990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816601992 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.816620111 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.816646099 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.816668034 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.819819927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.819845915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.819927931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.819963932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.820003986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.820211887 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.820235014 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.820281982 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.820291996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.820323944 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.820338964 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.831547022 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.831569910 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.831653118 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.831688881 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.831728935 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.833709002 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.833731890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.833915949 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.833946943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.833995104 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.834445000 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.834475040 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.834530115 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.834547997 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.834583044 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.834606886 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.904469013 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.904505968 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.904614925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.904639006 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.904685020 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.904766083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.904799938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.904830933 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.904839039 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.904916048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.904916048 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.905071974 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.905101061 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.905131102 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.905157089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.905179977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.905198097 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.908406973 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.908447981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.908473969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.908489943 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.908514977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.908586025 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.908731937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.908751965 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.908791065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.908797979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.908829927 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.908849001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.921242952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.921266079 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.921355963 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.921366930 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.921415091 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.924513102 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.924535990 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.924592972 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.924602985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.924654961 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.924668074 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.924891949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.924918890 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.924947977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.924956083 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.924989939 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.925025940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.994210005 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994240999 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994342089 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994399071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994425058 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.994448900 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994465113 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.994479895 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.994518042 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.994870901 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994894981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994932890 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.994940996 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.994992971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.997313976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.997344971 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.997442007 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.997472048 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.997473955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.997504950 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:21.997528076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:21.997565985 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.009877920 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.009922981 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.009970903 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.010016918 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.010036945 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.010061979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.014023066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.014061928 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.014110088 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.014128923 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.014163971 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.014174938 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.014200926 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.014210939 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.014233112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.014257908 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.014301062 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.083234072 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083266020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083363056 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083381891 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.083426952 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083460093 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.083503962 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.083600044 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083621979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083652973 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.083662033 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.083707094 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.085228920 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.085901976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.085957050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.085982084 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.086009979 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.086026907 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.086045980 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.086060047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.086087942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.086112022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.086118937 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.086177111 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.098644972 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.098673105 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.098733902 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.098766088 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.098792076 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.098809004 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.102380991 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.102405071 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.102448940 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.102480888 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.102504969 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.102767944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.102794886 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.102823019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.102834940 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.102854013 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.102889061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.171444893 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.171478987 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.171535015 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.171561956 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.171591997 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.171614885 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.171751976 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.171809912 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.171813965 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.171824932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.171864986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.172981977 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.173031092 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.173046112 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.173067093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.173084021 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.173105955 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174560070 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174608946 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174632072 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174652100 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174675941 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174685955 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174694061 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174704075 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174732924 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174747944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174768925 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174777031 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.174802065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.174834967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.188112020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.188144922 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.188209057 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.188245058 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.188266039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.188282967 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.191852093 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.191890001 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.191925049 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.191952944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.191972017 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.192044020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.192071915 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.192095041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.192106009 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.192130089 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.192162991 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260591984 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260623932 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260668039 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260689020 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260709047 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260735989 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260735989 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260759115 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260785103 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260811090 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260855913 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260880947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260905981 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260914087 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.260936022 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.260962009 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.263114929 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.263160944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.263186932 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.263195038 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.263216019 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.263243914 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.263683081 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.263704062 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.263756990 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.263762951 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.263812065 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.276119947 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.276150942 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.276211977 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.276231050 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.276266098 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.276288986 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.280345917 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.280384064 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.280426979 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.280435085 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.280488014 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.280586004 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.280606985 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.280642033 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.280647993 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.280675888 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.280697107 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349185944 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349250078 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349261999 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349278927 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349328041 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349421024 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349442959 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349478006 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349487066 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349504948 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349509001 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349533081 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349539995 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349565983 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349591017 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:22.349597931 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.349636078 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.353276968 CEST	49735	443	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:22.353297949 CEST	443	49735	156.146.33.140	192.168.2.4
Jun 22, 2024 06:28:24.539165974 CEST	49734	80	192.168.2.4	156.146.33.140
Jun 22, 2024 06:28:31.878046989 CEST	49742	80	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:31.882972002 CEST	80	49742	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:31.883205891 CEST	49742	80	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:31.883388996 CEST	49742	80	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:31.888138056 CEST	80	49742	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:32.724833965 CEST	80	49742	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:32.727543116 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:32.727600098 CEST	443	49743	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:32.727684021 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:32.748061895 CEST	80	49742	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:32.748239994 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:32.748276949 CEST	443	49743	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:32.748512030 CEST	49742	80	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:33.496810913 CEST	443	49743	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:33.496958017 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:33.526892900 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:33.526946068 CEST	443	49743	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:33.527986050 CEST	443	49743	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:33.574419975 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:33.865107059 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:33.869565010 CEST	49743	443	192.168.2.4	212.102.56.179
Jun 22, 2024 06:28:33.869616032 CEST	443	49743	212.102.56.179	192.168.2.4
Jun 22, 2024 06:28:33.869694948 CEST	49743	443	192.168.2.4	212.102.56.179

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 22, 2024 06:27:57.084840059 CEST	52045	53	192.168.2.4	1.1.1.1
Jun 22, 2024 06:27:57.263663054 CEST	53	52045	1.1.1.1	192.168.2.4
Jun 22, 2024 06:28:27.289388895 CEST	59043	53	192.168.2.4	1.1.1.1
Jun 22, 2024 06:28:31.856967926 CEST	49555	53	192.168.2.4	1.1.1.1
Jun 22, 2024 06:28:31.874263048 CEST	53	49555	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 22, 2024 06:27:57.084840059 CEST	192.168.2.4	1.1.1.1	0x2bac	Standard query (0)	static.adtidy.net	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:27.289388895 CEST	192.168.2.4	1.1.1.1	0x7d33	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.856967926 CEST	192.168.2.4	1.1.1.1	0xf330	Standard query (0)	static.adguard.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	static.adtidy.net	1523296349.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		156.146.33.140	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		195.181.175.15	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		212.102.56.179	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		195.181.175.40	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		156.146.33.15	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		156.146.33.138	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:27:57.263663054 CEST	1.1.1.1	192.168.2.4	0x2bac	No error (0)	1523296349.rsc.cdn77.org		212.102.56.182	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:27.296632051 CEST	1.1.1.1	192.168.2.4	0x7d33	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	static.adguard.com	1625341327.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		212.102.56.179	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		156.146.33.14	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		195.181.175.15	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		156.146.33.140	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		156.146.33.137	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		195.181.175.41	A (IP address)	IN (0x0001)	false
Jun 22, 2024 06:28:31.874263048 CEST	1.1.1.1	192.168.2.4	0xf330	No error (0)	1625341327.rsc.cdn77.org		212.102.56.182	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

static.adtidy.net

static.adguard.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	156.146.33.140	80	7080	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Timestamp	Bytes transferred	Direction	Data
Jun 22, 2024 06:27:57.276818991 CEST	103	OUT	GET /windows/installer.exe HTTP/1.1 User-Agent: AdGuard VPN Web Installer Host: static.adtidy.net
Jun 22, 2024 06:27:57.906656981 CEST	1125	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 22 Jun 2024 04:27:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://static.adtidy.net/windows/installer.exe Server: CDN77-Turbo X-77-NZT: EQgBnJIhiwAA X-77-NZT-Ray: cf8787278684300bcd527666235abe30 X-77-POP: frankfurtDE X-77-Cache: MISS Data Raw: 33 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 63 2e 63 64 6e 37 37 2e 6f 72 67 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 28 63 29 20 32 30 32 33 20 43 44 4e 37 37 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c [TRUNCATED] Data Ascii: 304<!DOCTYPE html><head> <base href="https://error.c.cdn77.org/" target="_blank"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="author" content="(c) 2023 CDN77"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="css/main.css"> <link rel="shortcut icon" href="img/favicon.ico" /> <title>Moved Permanently</title></head><body style="background-color: #0d5284; color: #fff;" class="Header-wrap"> <h1> <small class="Header-errorNumber"> 301 Redirect</small><br> Moved Permanently </h1> <p class="Header-description"> This resource has been permanently moved to a new location.</p></body>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49742	212.102.56.179	80	6016	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Timestamp	Bytes transferred	Direction	Data
Jun 22, 2024 06:28:31.883388996 CEST	87	OUT	GET /installer.v1.0.json HTTP/1.1 Host: static.adguard.com Connection: Keep-Alive
Jun 22, 2024 06:28:32.724833965 CEST	1124	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 22 Jun 2024 04:28:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://static.adguard.com/installer.v1.0.json Server: CDN77-Turbo X-77-NZT: EQgB1GY4sQAA X-77-NZT-Ray: 1cb09c0ee2788686f052766683dc2d1a X-77-POP: frankfurtDE X-77-Cache: MISS Data Raw: 33 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 63 2e 63 64 6e 37 37 2e 6f 72 67 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 28 63 29 20 32 30 32 33 20 43 44 4e 37 37 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c [TRUNCATED] Data Ascii: 304<!DOCTYPE html><head> <base href="https://error.c.cdn77.org/" target="_blank"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="author" content="(c) 2023 CDN77"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="css/main.css"> <link rel="shortcut icon" href="img/favicon.ico" /> <title>Moved Permanently</title></head><body style="background-color: #0d5284; color: #fff;" class="Header-wrap"> <h1> <small class="Header-errorNumber"> 301 Redirect</small><br> Moved Permanently </h1> <p class="Header-description"> This resource has been permanently moved to a new location.</p></body>0
Jun 22, 2024 06:28:32.748061895 CEST	1124	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 22 Jun 2024 04:28:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://static.adguard.com/installer.v1.0.json Server: CDN77-Turbo X-77-NZT: EQgB1GY4sQAA X-77-NZT-Ray: 1cb09c0ee2788686f052766683dc2d1a X-77-POP: frankfurtDE X-77-Cache: MISS Data Raw: 33 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 63 2e 63 64 6e 37 37 2e 6f 72 67 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 28 63 29 20 32 30 32 33 20 43 44 4e 37 37 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c [TRUNCATED] Data Ascii: 304<!DOCTYPE html><head> <base href="https://error.c.cdn77.org/" target="_blank"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="author" content="(c) 2023 CDN77"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="css/main.css"> <link rel="shortcut icon" href="img/favicon.ico" /> <title>Moved Permanently</title></head><body style="background-color: #0d5284; color: #fff;" class="Header-wrap"> <h1> <small class="Header-errorNumber"> 301 Redirect</small><br> Moved Permanently </h1> <p class="Header-description"> This resource has been permanently moved to a new location.</p></body>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	156.146.33.140	443	7080	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 04:27:58 UTC	127	OUT	GET /windows/installer.exe HTTP/1.1 User-Agent: AdGuard VPN Web Installer Host: static.adtidy.net Connection: Keep-Alive
2024-06-22 04:27:59 UTC	671	IN	HTTP/1.1 200 OK Date: Sat, 22 Jun 2024 04:27:59 GMT Content-Type: application/x-msdos-program Content-Length: 33343848 Connection: close Last-Modified: Wed, 15 May 2024 00:27:21 GMT x-rgw-object-type: Normal ETag: "b005e4007eb93f23bb0e7f03fb634d46" x-amz-request-id: tx00000320fe9a91d2bbc7f-006675a1ce-64e5e44-prg X-77-NZT: A5ySIYs3Nzf/ZQcAACUTwjE3Nzf/qw4AAG09Wg6mQHMA X-77-NZT-Ray: cf878727807f542ccf5276669e93b704 X-Accel-Expires: @1719042836 X-Accel-Date: 1719028586 X-77-Cache: HIT X-77-Age: 1893 Server: CDN77-Turbo Alt-Svc: h3=":443"; ma=86400 X-Accel-Date-Max: 1718988921 X-Cache: HIT X-Age: 1893 X-77-POP: frankfurtDE Accept-Ranges: bytes
2024-06-22 04:27:59 UTC	15713	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 0a 6f fb 7d 6b 01 a8 7d 6b 01 a8 7d 6b 01 a8 c9 f7 f0 a8 77 6b 01 a8 c9 f7 f2 a8 00 6b 01 a8 c9 f7 f3 a8 65 6b 01 a8 2f 03 05 a9 6e 6b 01 a8 2f 03 02 a9 69 6b 01 a8 2f 03 04 a9 56 6b 01 a8 74 13 82 a8 78 6b 01 a8 74 13 92 a8 6c 6b 01 a8 7d 6b 00 a8 28 6a 01 a8 eb 02 04 a9 36 6b 01 a8 eb 02 fe a8 7c 6b 01 a8 7d 6b 96 a8 7f 6b 01 a8 eb 02 03 a9 7c 6b 01 a8 52 69 63 68 7d 6b 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9o}k}k}kwkkek/nk/ik/Vktxktlk}k(j6k\|k}kk\|kRich}k
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 00 e9 27 01 00 00 ff 15 a0 a1 44 00 89 87 98 04 00 00 83 f8 ff 75 38 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 4c 02 00 00 68 8c aa 44 00 e8 14 ef ff ff 68 fc ae 44 00 e9 de 00 00 00 ff b7 b0 04 00 00 50 ff 15 a8 a1 44 00 85 c0 75 38 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 51 02 00 00 68 8c aa 44 00 e8 cb ee ff ff 68 38 af 44 00 e9 95 00 00 00 57 68 9e 45 40 00 e8 5d b5 03 00 57 ff 75 08 e8 c1 9e 01 00 8b f0 85 f6 79 07 68 d8 ad 44 00 eb 74 6a 01 e8 f0 ca 03 00 8d 47 18 50 8d 87 f8 00 00 00 50 8d 45 f8 50 8d 45 fc 50 8d 87 b8 00 00 00 50 8d 87 00 01 00 00 50 8d 87 88 00 00 00 50 8d 87 b8 02 00 00 50 8d 87 c0 02 00 00 50 8d 87 a8 02 00 00 50 8d 87 Data Ascii: 'Du8D~x@VhLhDhDPDu8D~x@VhQhDh8DWhE@]WuyhDtjGPPEPEPPPPPPP
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 2f 8b 4d 0c 8b 45 10 23 4d 14 23 45 18 0b c8 eb e9 8b 4d 0c 8b 45 10 0f ac c1 10 0f b7 c1 eb 04 0f b7 45 0c 3b 45 14 75 05 3b 55 18 74 ce 8b ca 8b 45 1c 89 08 eb 05 ba 57 00 07 80 8b c2 5d c2 18 00 90 c8 88 40 00 fd 88 40 00 15 89 40 00 29 89 40 00 3d 89 40 00 4d 89 40 00 62 89 40 00 72 89 40 00 81 89 40 00 fd 88 40 00 15 89 40 00 29 89 40 00 3d 89 40 00 4d 89 40 00 62 89 40 00 72 89 40 00 81 89 40 00 55 8b ec 51 53 56 8b 35 04 a1 44 00 33 db 57 8b 7d 08 8b c7 ff 75 0c c1 e8 11 83 e0 01 89 45 fc ff d6 ff 75 10 89 45 08 ff d6 8b f0 81 ff 0a 00 03 00 7f 5f 81 ff 05 00 03 00 7d 2c 81 ff 05 00 01 00 7c 61 81 ff 0a 00 01 00 7e 1c 81 ff 0b 00 01 00 0f 84 96 00 00 00 81 ff 0c 00 01 00 74 67 81 ff 0d 00 01 00 eb 3b 56 ff 75 10 ff 75 08 ff 75 0c ff 75 fc 6a 7f ff Data Ascii: /ME#M#EMEE;Eu;UtEW]@@@)@=@M@b@r@@@@)@=@M@b@r@@UQSV5D3W}uEuE_},\|a~tg;Vuuuuj
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 6a 76 68 e4 ea 44 00 e8 35 6f ff ff ff 77 08 68 c0 eb 44 00 56 e8 76 31 03 00 83 c4 0c eb 14 68 98 eb 44 00 eb 05 68 6c eb 44 00 56 e8 5f 31 03 00 59 59 5f 8b c6 5e 5b c9 c2 08 00 55 8b ec 56 8b 75 08 8b 06 85 c0 74 66 53 33 db 39 5e 04 76 57 33 c0 89 45 08 57 8b 3e 03 f8 83 7f 0c 00 74 0d ff 77 0c ff 15 e0 a0 44 00 83 67 0c 00 83 3f 00 74 07 ff 37 e8 6f 5d ff ff 83 7f 08 00 74 08 ff 77 08 e8 61 5d ff ff 83 7f 04 00 74 08 ff 77 04 e8 53 5d ff ff 8b 45 08 43 83 c0 10 89 45 08 3b 5e 04 72 b2 8b 06 5f 50 e8 7d 70 ff ff 5b 83 26 00 83 66 04 00 5e 5d c2 04 00 55 8b ec 83 ec 0c 56 57 8d 45 f4 33 ff 50 68 90 ea 44 00 ff 75 0c 89 7d f4 89 7d fc 89 7d f8 e8 2b 67 03 00 8b f0 85 f6 79 12 68 a0 Data Ascii: ~x@VjvhD5owhDVv1hDhlDV_1YY_^[UVutfS39^vW3EW>twDg?t7o]twa]twS]ECE;^r_P}p[&f^]UVWE3PhDu}}}+gyh
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 39 5e 60 74 08 ff 76 60 e8 f4 1d ff ff 39 5e 64 74 08 ff 76 64 e8 e7 1d ff ff 39 5e 68 74 08 ff 76 68 e8 da 1d ff ff 39 5e 6c 74 08 ff 76 6c e8 cd 1d ff ff 39 5e 70 74 08 ff 76 70 e8 c0 1d ff ff 39 5e 74 74 08 ff 76 74 e8 b3 1d ff ff 39 5e 78 74 08 ff 76 78 e8 a6 1d ff ff 39 5e 7c 74 08 ff 76 7c e8 99 1d ff ff 8b 86 80 00 00 00 85 c0 74 06 50 e8 89 1d ff ff 8b 86 84 00 00 00 85 c0 74 06 50 e8 79 1d ff ff 8b 86 a0 00 00 00 85 c0 74 06 50 e8 69 1d ff ff 8b 86 a4 00 00 00 85 c0 74 06 50 e8 59 1d ff ff 8b 86 a8 00 00 00 85 c0 74 06 50 e8 49 1d ff ff 8b 86 ac 00 00 00 85 c0 74 06 50 e8 39 1d ff ff 8b 86 b0 00 00 00 85 c0 74 06 50 e8 29 1d ff ff 8b 86 94 00 00 00 85 c0 74 79 39 9e 98 00 00 00 76 69 33 ff 8b 14 38 8b c8 85 d2 74 0e 52 e8 06 1d ff ff 8b 86 94 00 Data Ascii: 9^`tv`9^dtvd9^htvh9^ltvl9^ptvp9^ttvt9^xtvx9^\|tv\|tPtPytPitPYtPItP9tP)ty9vi38tR
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 56 68 18 03 00 00 68 a4 33 45 00 e8 49 ef fe ff 68 90 3a 45 00 56 e8 8d b1 02 00 59 59 eb 62 33 c9 33 c0 33 f6 89 4d f4 89 45 f8 46 eb 9a 6a 00 8d 4d fc 51 ff 77 04 50 ff 75 08 ff 15 fc a1 44 00 85 c0 75 35 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 27 03 00 00 68 a4 33 45 00 e8 e6 ee fe ff 68 dc 3a 45 00 eb 9b c7 47 08 01 00 00 00 83 7f 08 00 75 0e 83 7f 0c 00 74 08 ff 77 0c e8 ae f0 fe ff 5f 8b c6 5e 5b c9 c2 08 00 55 8b ec 51 51 56 57 8d 45 fc 33 ff 50 8d 45 f8 89 7d f8 50 ff 75 14 89 7d fc ff 75 10 ff 75 0c e8 aa fb ff ff 8b f0 85 f6 79 07 68 40 3a 45 00 eb 61 89 7d 14 39 7d fc 76 61 6a 00 8d 45 14 50 8b 45 fc 2b c7 50 ff 75 f8 ff 75 08 ff 15 3c a1 44 00 85 c0 74 0a 03 7d 14 3b 7d fc 72 dc eb 3b ff Data Ascii: Vhh3EIh:EVYYb333MEFjMQwPuDu5D~x@Vh'h3Eh:EGutw_^[UQQVWE3PE}Pu}uuyh@:Ea}9}vajEPE+Puu<Dt};}r;
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 39 75 08 0f 84 30 01 00 00 39 35 78 aa 46 00 75 63 8d 45 fc 50 6a 23 e8 2b ac fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 70 62 45 00 e9 84 01 00 00 bf 78 aa 46 00 57 68 e0 53 45 00 ff 75 fc e8 b0 a4 fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 9c 62 45 00 e9 5c 01 00 00 57 e8 3e a2 fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 d8 62 45 00 e9 41 01 00 00 a1 7c aa 46 00 85 c0 75 68 bf 7c aa 46 00 57 56 68 20 63 45 00 68 38 53 45 00 e8 77 c6 02 00 8b d8 85 db 79 12 68 3c 63 45 00 53 e8 04 71 02 00 59 59 e9 13 01 00 00 39 35 7c aa 46 00 74 13 57 e8 e4 a1 fe ff 8b d8 85 db 79 21 68 70 63 45 00 eb d8 56 ff 35 78 aa 46 00 57 e8 6a 98 fe ff 8b d8 85 db 79 07 68 c8 63 45 00 eb be a1 7c aa 46 00 39 75 0c 75 05 a1 78 aa 46 00 56 8b 75 10 50 56 e8 43 98 fe ff 8b d8 85 db 79 Data Ascii: 9u095xFucEPj#+yhtWEhpbExFWhSEuyhtWEhbE\W>yhtWEhbEA\|Fuh\|FWVh cEh8SEwyh<cESqYY95\|FtWy!hpcEV5xFWjyhcE\|F9uuxFVuPVCy
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 50 8d 45 fc 50 ff 77 04 ff 77 0c e8 d9 25 02 00 8b f0 85 f6 79 07 68 00 7f 45 00 eb 96 8b 45 f8 6a 01 c1 e0 02 50 e8 53 70 fe ff 8b d8 85 db 75 1f be 0e 00 07 80 56 68 f0 04 00 00 68 b0 6e 45 00 e8 13 6f fe ff 68 1c 7f 45 00 e9 63 ff ff ff 33 c0 89 45 08 8b 45 f8 85 c0 74 32 8b d3 89 5d f0 52 8d 45 fc 50 ff 77 04 ff 77 0c e8 d1 25 02 00 8b f0 85 f6 78 6e 8b 4d 08 8b 55 f0 41 8b 45 f8 83 c2 04 89 4d 08 89 55 f0 3b c8 72 d3 89 45 e8 89 5d ec 8b 45 0c 8d 4d e0 ff 70 04 51 ff 10 8b 4d 10 89 01 83 7d f4 00 74 08 ff 75 f4 e8 4e 5d fe ff 85 db 74 25 8b 45 f8 85 c0 74 18 33 ff 83 3c bb 00 74 0b ff 34 bb e8 33 5d fe ff 8b 45 f8 47 3b f8 72 ea 53 e8 67 70 fe ff 5f 8b c6 5e 5b c9 c2 0c 00 8b 45 08 50 68 48 7f 45 00 56 e8 b4 30 02 00 83 c4 0c eb ac 8d 45 e8 c7 45 e0 Data Ascii: PEPww%yhEEjPSpuVhhnEohEc3EEt2]REPww%xnMUAEMU;rE]EMpQM}tuN]t%Et3<t43]EG;rSgp_^[EPhHEV0EE
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: e8 01 74 0c bf 9f 13 07 80 68 c0 a1 45 00 eb 72 8b 43 44 2b 43 48 56 8b 75 10 56 ff 75 0c 50 8b 43 40 03 43 48 50 e8 ec 32 fe ff 83 c4 10 01 73 48 89 75 fc 5e eb 53 57 8d 45 fc 50 ff 75 10 ff 75 0c ff 73 3c ff 15 3c a1 44 00 85 c0 75 3b ff 15 f4 a0 44 00 8b f8 85 ff 7e 0b 0f b7 ff 81 cf 00 00 07 80 85 ff 78 05 bf 05 40 00 80 57 68 04 03 00 00 68 28 9d 45 00 e8 dc 2e fe ff 68 94 a1 45 00 57 e8 20 f1 01 00 59 59 89 7b 30 85 ff 5f 5b 79 05 83 c8 ff c9 c3 8b 45 fc c9 c3 55 8b ec 83 ec 10 56 57 8b 7d 08 33 f6 89 75 f0 89 75 f4 89 75 f8 8b 47 2c 48 89 75 fc 83 e8 01 74 3a 83 e8 01 0f 84 80 00 00 00 48 83 e8 01 74 24 be 9f 13 07 80 56 68 96 02 00 00 68 28 9d 45 00 e8 76 2e fe ff 68 d8 9f 45 00 56 e8 ba f0 01 00 59 59 eb 56 be 04 40 00 80 eb 4f 8b 4d 0c 8d 45 f0 Data Ascii: thErCD+CHVuVuPC@CHP2sHu^SWEPuus<<Du;D~x@Whh(E.hEW YY{0_[yEUVW}3uuuG,Hut:Ht$Vhh(Ev.hEVYYV@OME
2024-06-22 04:27:59 UTC	16384	IN	Data Raw: 50 e8 78 f0 fd ff 89 87 bc 00 00 00 85 c0 75 1f bf 0e 00 07 80 57 6a 62 68 10 ad 45 00 8b f7 e8 35 ef fd ff 68 44 ad 45 00 57 e9 ef fe ff ff 8b 45 f4 83 65 08 00 89 87 c0 00 00 00 85 c0 0f 84 50 01 00 00 33 c9 89 4d ec 8b 87 bc 00 00 00 03 c1 89 45 0c 8d 45 fc 6a 00 50 ff 75 f8 e8 1f e7 01 00 8b f0 85 f6 0f 88 a3 01 00 00 ff 75 0c 68 64 bb 44 00 ff 75 fc e8 80 e1 01 00 8b f0 85 f6 0f 88 7f 01 00 00 8b 45 0c 83 c0 04 50 68 78 ad 45 00 ff 75 fc e8 62 e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 1d 01 00 00 8b 45 0c 83 c0 08 50 68 c0 ad 45 00 ff 75 fc e8 3c e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 01 01 00 00 8b 45 0c 83 c0 0c 50 68 0c ae 45 00 ff 75 fc e8 16 e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 e5 00 00 00 8b 45 0c 83 c0 10 50 Data Ascii: PxuWjbhE5hDEWEeP3MEEjPuuhdDuEPhxEubtEPhEu<tEPhEutEP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	212.102.56.179	443	6016	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-22 04:28:33 UTC	87	OUT	GET /installer.v1.0.json HTTP/1.1 Host: static.adguard.com Connection: Keep-Alive

Target ID:	0
Start time:	00:27:56
Start date:	22/06/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe"
Imagebase:	0x960000
File size:	116'256 bytes
MD5 hash:	68B15ABF143F5DF8AAD10EAB1D2513D5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:28:23
Start date:	22/06/2024
Path:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe AID=18672
Imagebase:	0x3d0000
File size:	33'343'848 bytes
MD5 hash:	B005E4007EB93F23BB0E7F03FB634D46
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	00:28:23
Start date:	22/06/2024
Path:	C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=700 -burn.filehandle.self=708 AID=18672
Imagebase:	0xdb0000
File size:	7'303'192 bytes
MD5 hash:	29467FD9BE93C4AC0BA9D863AE30EDF9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000002.2938642138.0000000006E82000.00000002.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000002.2937823185.0000000006B42000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000002.2934781253.00000000063F2000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000005.00000002.2938282239.0000000006C32000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.7%
Total number of Nodes:	1635
Total number of Limit Nodes:	9

Executed Functions

Function 00968170 Relevance: 91.6, APIs: 45, Strings: 7, Instructions: 599
memorywindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0096818A
strlen.MSVCRT ref: 0096819E
HeapAlloc.KERNEL32 ref: 009681B9
memchr.MSVCRT ref: 00968207
memchr.MSVCRT ref: 00968226
memchr.MSVCRT ref: 00968261
memchr.MSVCRT ref: 009682AC
HeapAlloc.KERNEL32 ref: 00968308
HeapFree.KERNEL32 ref: 009683A5
GetLastError.KERNEL32 ref: 00968403

Part of subcall function 00969B84: strlen.MSVCRT ref: 00969B91

HeapAlloc.KERNEL32 ref: 0096845C
GdiplusStartup.GDIPLUS ref: 009684AF
GetCurrentThreadId.KERNEL32 ref: 009684C0
GetDC.USER32 ref: 009684CD
GetDeviceCaps.GDI32 ref: 009684E5
ReleaseDC.USER32 ref: 009684FD
GetModuleHandleW.KERNEL32 ref: 009685BA
LoadIconW.USER32 ref: 009685DD
LoadCursorW.USER32 ref: 009685FA
RegisterClassExW.USER32(00000000), ref: 00968612
SendMessageW.USER32 ref: 00968690
SendMessageW.USER32 ref: 009686B1
SetWindowLongW.USER32(00000000,00000000), ref: 009686EF

Part of subcall function 0096B104: GlobalAlloc.KERNEL32 ref: 0096B132
Part of subcall function 0096B104: GlobalLock.KERNEL32 ref: 0096B148
Part of subcall function 0096B104: GlobalFree.KERNEL32 ref: 0096B15B

ShowWindow.USER32 ref: 009687B1

Part of subcall function 0096B2AC: GetDC.USER32 ref: 0096B2C4
Part of subcall function 0096B2AC: CreateCompatibleDC.GDI32 ref: 0096B2D1
Part of subcall function 0096B2AC: SelectObject.GDI32 ref: 0096B2F0
Part of subcall function 0096B2AC: GdipCreateFromHDC.GDIPLUS ref: 0096B351
Part of subcall function 0096B2AC: GdipCreateSolidFill.GDIPLUS ref: 0096B385
Part of subcall function 0096B2AC: GdipFillRectangleI.GDIPLUS ref: 0096B3BB
Part of subcall function 0096B2AC: GdipDeleteGraphics.GDIPLUS(?,?,?,0096B642), ref: 0096B3DA
Part of subcall function 0096B2AC: CreateCompatibleDC.GDI32(00000000), ref: 0096B3E6

Part of subcall function 0096929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,009687C3,00000000), ref: 009693A1
Part of subcall function 0096929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009693BE

GetLastError.KERNEL32(00000000,00000000), ref: 009687C9

Part of subcall function 009693D8: GetLocaleInfoW.KERNEL32 ref: 0096941D
Part of subcall function 009693D8: GetWindowLongW.USER32 ref: 0096945E
Part of subcall function 009693D8: SetWindowLongW.USER32 ref: 00969482
Part of subcall function 009693D8: ShowWindow.USER32 ref: 00969514
Part of subcall function 009693D8: SendMessageW.USER32(00000000,00000000), ref: 0096955D
Part of subcall function 009693D8: SendMessageW.USER32 ref: 00969588

CreateThread.KERNEL32(?,?,00000000,00000000), ref: 00968821
KiUserCallbackDispatcher.NTDLL(00000030), ref: 00968859
GetParent.USER32 ref: 00968890
TranslateAcceleratorW.USER32 ref: 009688DD
TranslateMessage.USER32 ref: 009688F1
DispatchMessageW.USER32 ref: 009688FB

Part of subcall function 0096B220: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 0096B242
Part of subcall function 0096B220: GdipGetImageWidth.GDIPLUS ref: 0096B265
Part of subcall function 0096B220: GdipGetImageHeight.GDIPLUS ref: 0096B28A

Part of subcall function 0096AE88: SetWindowPos.USER32 ref: 0096AEEB

Part of subcall function 0096B104: GlobalUnlock.KERNEL32 ref: 0096B177
Part of subcall function 0096B104: CreateStreamOnHGlobal.OLE32(00000000), ref: 0096B193
Part of subcall function 0096B104: GlobalFree.KERNEL32 ref: 0096B1A6

WaitForSingleObject.KERNEL32 ref: 00968929
GetExitCodeThread.KERNEL32 ref: 0096893F
CloseHandle.KERNEL32(00000000,00000000), ref: 0096894A
DeleteObject.GDI32 ref: 00968974
DeleteObject.GDI32(00000001), ref: 00968985
GdiplusShutdown.GDIPLUS(00000000), ref: 00968996
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 009689AC
UnregisterClassW.USER32 ref: 009689BE
HeapFree.KERNEL32(00000000), ref: 009689E9
HeapFree.KERNEL32 ref: 00968A2A
HeapFree.KERNEL32 ref: 00968A46
HeapFree.KERNEL32 ref: 00968A62
HeapFree.KERNEL32 ref: 00968A7E
HeapFree.KERNEL32 ref: 00968AB6

Strings

X, xrefs: 009684DA
0, xrefs: 009685AC
ADGUARD_WI_WNDCLASS, xrefs: 009685CB, 009689B7
https_url, xrefs: 00968376
setup_args, xrefs: 00968328
AdGuard VPN Web Installer, xrefs: 00968645
http_url, xrefs: 00968352

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$CreateGdip$GlobalMessageWindow$AllocObjectSendmemchr$DeleteHandleLongThread$ClassCompatibleErrorFillFromGdiplusImageLastLoadModuleShowTranslatestrlen$AcceleratorBitmapCallbackCapsCloseCodeCurrentCursorDeviceDispatchDispatcherExitGraphicsHeightIconInfoLocaleLockParentProcessRectangleRegisterReleaseSelectShutdownSingleSolidStartupStreamUnlockUnregisterUserWaitWidth
String ID: 0$ADGUARD_WI_WNDCLASS$AdGuard VPN Web Installer$X$http_url$https_url$setup_args
API String ID: 4084662147-2100270031
Opcode ID: 6841e43039f99c701dadf516165535424485bc38eead21d550f85bceb466ea92
Instruction ID: 3849869fb69c654b860047924603f0c9d3c5840bbec745a8a42a6771e778f847
Opcode Fuzzy Hash: 6841e43039f99c701dadf516165535424485bc38eead21d550f85bceb466ea92
Instruction Fuzzy Hash: 064236B0A193058FDB00EFA9D98875EBBF4FF84344F14892DE8989B364DB749845DB42

Function 00968E34 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 218
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00969F00: DeleteFileW.KERNEL32 ref: 00969F3A
Part of subcall function 00969F00: HeapFree.KERNEL32 ref: 00969F59

Part of subcall function 00969DB8: CreateFileW.KERNEL32 ref: 00969EB6
Part of subcall function 00969DB8: HeapFree.KERNEL32 ref: 00969EE5

GetLastError.KERNEL32 ref: 00968E5C
InternetOpenW.WININET ref: 00968F1E
InternetOpenUrlW.WININET ref: 00968F76
InternetReadFile.WININET ref: 0096904D
WriteFile.KERNEL32 ref: 00969084
HeapFree.KERNEL32 ref: 009690D9
InternetCloseHandle.WININET ref: 009690EB
InternetCloseHandle.WININET ref: 009690F1
GetLastError.KERNEL32 ref: 00969103

Part of subcall function 00968CD8: HeapAlloc.KERNEL32 ref: 00968D1C

CloseHandle.KERNEL32 ref: 00969130

Strings

https://, xrefs: 00968F34
AdGuard VPN Web Installer, xrefs: 00968F17

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Internet$FileHeap$CloseFreeHandle$ErrorLastOpen$AllocCreateDeleteReadWrite
String ID: AdGuard VPN Web Installer$https://
API String ID: 430734991-2703855203
Opcode ID: 23c0109f34daab56c39f63d89b70829c6ffcf6d62c0e498ce4ff89723396188c
Instruction ID: 8be8153651c1f26211de0ea22976fa2f08d528f3adcec191d9c600bc087399e3
Opcode Fuzzy Hash: 23c0109f34daab56c39f63d89b70829c6ffcf6d62c0e498ce4ff89723396188c
Instruction Fuzzy Hash: 1A915C70A083059FDB10EFA9D98479EBBF9BF89310F108629E458A7294DB75C805CF92

Function 0096117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 009611C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00961248
__p__acmdln.MSVCRT ref: 00961271
malloc.MSVCRT ref: 009612FB
strlen.MSVCRT ref: 0096132B
malloc.MSVCRT ref: 00961336
memcpy.MSVCRT ref: 0096134C
GetStartupInfoA.KERNEL32 ref: 00961443

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 0b5d355e6d381be5d6b557c0030f329f2e534665842f5fd753fe3869f73157e9
Instruction ID: c242718c49bb887946369ae1dd6b23660fc8295aac01aeafccdcdf30e1027122
Opcode Fuzzy Hash: 0b5d355e6d381be5d6b557c0030f329f2e534665842f5fd753fe3869f73157e9
Instruction Fuzzy Hash: 3B819C72A18340CFDB10EFA8D99136DB7F4FB45344F188829DA89C7321D7399884EB92

Function 009613D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00961248
__p__acmdln.MSVCRT ref: 00961271
malloc.MSVCRT ref: 009612FB
strlen.MSVCRT ref: 0096132B
malloc.MSVCRT ref: 00961336
memcpy.MSVCRT ref: 0096134C
_amsg_exit.MSVCRT ref: 009613F2
_initterm.MSVCRT ref: 00961414

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 9157044fbc0242907de631e249fb1530308eae682b46f5774ef65ad032de49c7
Instruction ID: 29dee289c96348f8392dec105da316fae2f0cced8ced2e78495e4a6b502eb52c
Opcode Fuzzy Hash: 9157044fbc0242907de631e249fb1530308eae682b46f5774ef65ad032de49c7
Instruction Fuzzy Hash: BC4118B5A183418FDB10EFA8D98135DBBF4FB45344F14882DE988C7321D7749885EB51

Function 009611B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 009611C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00961248
__p__acmdln.MSVCRT ref: 00961271
malloc.MSVCRT ref: 009612FB
strlen.MSVCRT ref: 0096132B
malloc.MSVCRT ref: 00961336
memcpy.MSVCRT ref: 0096134C
_amsg_exit.MSVCRT ref: 009613F2
_initterm.MSVCRT ref: 00961414

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 057a9bf91af58683180e32824362c3fc4addb74dad93bfbb999efe5c659efc69
Instruction ID: 074a2c6183f58c07be18722b0d29c0c2f2ea9e00c407dc62b776092f0fd80c8b
Opcode Fuzzy Hash: 057a9bf91af58683180e32824362c3fc4addb74dad93bfbb999efe5c659efc69
Instruction Fuzzy Hash: 4D4159B1A183418FDB10EFA9D98172DB7F4BB45344F18482DE989C7320EB749885EB91

Function 00961170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 009611C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00961248
__p__acmdln.MSVCRT ref: 00961271
malloc.MSVCRT ref: 009612FB
strlen.MSVCRT ref: 0096132B
malloc.MSVCRT ref: 00961336
memcpy.MSVCRT ref: 0096134C
GetStartupInfoA.KERNEL32 ref: 00961443

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 864ff10810afdb4caeff6c5c884c84c6c9525a83846349b818071e38df144991
Instruction ID: 0e8d607c35c9a0194fd9e99a7590ff39a175bacf75dd304865d992297f3da1a0
Opcode Fuzzy Hash: 864ff10810afdb4caeff6c5c884c84c6c9525a83846349b818071e38df144991
Instruction Fuzzy Hash: E8518E76A28341CFDB10DFA9D98176AB7F4FB45344F18852DE948C7321DB349881EB91

Function 00969998 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,00000000,00000001,?,?,009683D3), ref: 009699AC
FindResourceW.KERNEL32 ref: 009699C4
SizeofResource.KERNEL32(?,?,?,?,?,00000000,00000001,?,?,009683D3), ref: 009699DF
LoadResource.KERNEL32(?,?,?,?,?,?,?,00000000,00000001,?,?,009683D3), ref: 009699F4
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,009683D3), ref: 009699FF

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModuleSizeof
String ID:
API String ID: 1601749889-0
Opcode ID: da079aae7b5620186ae7945f53374664c7bbd831eac1d181f699b3315e92c005
Instruction ID: 40d27a736695f0f77381741ed461ccacb4d2ff7a75617e443fbdd5509f05f222
Opcode Fuzzy Hash: da079aae7b5620186ae7945f53374664c7bbd831eac1d181f699b3315e92c005
Instruction Fuzzy Hash: 6C012CB2928701AFD7006F789D4862ABBFCFB88751F018A2EF499C3250E77088409B52

Function 0096B6A8 Relevance: 44.4, APIs: 24, Strings: 1, Instructions: 694windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0096B772
FillRect.USER32(?,?), ref: 0096B78B
GetFocus.USER32 ref: 0096BBC7
GetClientRect.USER32 ref: 0096BC26
SetWindowPos.USER32 ref: 0096BD33
PostQuitMessage.USER32 ref: 0096BFF6
SetWindowLongW.USER32 ref: 0096C01B

Strings

N, xrefs: 0096B751

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Rect$ClientWindow$FillFocusLongMessagePostQuit
String ID: N
API String ID: 3298376866-1130791706
Opcode ID: 896a9b3600541f2d494512678dfc3880e9591b1bdf3ee5044ec311536619f1b2
Instruction ID: 71ed8daf082ffce6c6a9cc182348ef036559d176be61e2306cb511b6f6e272f1
Opcode Fuzzy Hash: 896a9b3600541f2d494512678dfc3880e9591b1bdf3ee5044ec311536619f1b2
Instruction Fuzzy Hash: 1D5217B0A19205CFCB24DFA8C598A6EBBF8FF44344F148929E499DB255E334D885DF42

Function 0096B2AC Relevance: 16.7, APIs: 11, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32 ref: 0096B2C4
CreateCompatibleDC.GDI32 ref: 0096B2D1
SelectObject.GDI32 ref: 0096B2F0
GdipCreateFromHDC.GDIPLUS ref: 0096B351
GdipCreateSolidFill.GDIPLUS ref: 0096B385
GdipFillRectangleI.GDIPLUS ref: 0096B3BB
GdipDeleteGraphics.GDIPLUS(?,?,?,0096B642), ref: 0096B3DA
CreateCompatibleDC.GDI32(00000000), ref: 0096B3E6
AlphaBlend.MSIMG32 ref: 0096B460
UpdateLayeredWindow.USER32 ref: 0096B514
ReleaseDC.USER32(00000000), ref: 0096B54B

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: CreateGdip$CompatibleFill$AlphaBlendDeleteFromGraphicsLayeredObjectRectangleReleaseSelectSolidUpdateWindow
String ID:
API String ID: 545367414-0
Opcode ID: 2f1305d2d8055777a0b3011bb466896c73743865e04b37ebef1b2275d1720740
Instruction ID: acf690646fac9cb805e192ec0654d7ffcb952ab22a849493ce7df50c76a5eaab
Opcode Fuzzy Hash: 2f1305d2d8055777a0b3011bb466896c73743865e04b37ebef1b2275d1720740
Instruction Fuzzy Hash: FA9190B5D193089FDB00DFA9D984A9EBBF4FB88300F04892EE898E7314E77499448F51

Function 00969144 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,009687C3,00000000), ref: 009693A1
Part of subcall function 0096929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009693BE

Part of subcall function 0096ABB8: strlen.MSVCRT ref: 0096ABD2
Part of subcall function 0096ABB8: HeapAlloc.KERNEL32 ref: 0096AC34
Part of subcall function 0096ABB8: MultiByteToWideChar.KERNEL32 ref: 0096AC68
Part of subcall function 0096ABB8: HeapFree.KERNEL32 ref: 0096AC8B

CreateProcessW.KERNEL32 ref: 00969204
CloseHandle.KERNEL32 ref: 0096921A
HeapFree.KERNEL32 ref: 00969241
HeapFree.KERNEL32 ref: 0096925D
CloseHandle.KERNEL32 ref: 0096926F
HeapFree.KERNEL32 ref: 0096928A

Strings

%s %s%Z, xrefs: 00969165
D, xrefs: 009691BB

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$CloseHandle$AllocByteCharCreateMultiProcessWidestrlen
String ID: %s %s%Z$D
API String ID: 2791976147-1551950450
Opcode ID: 264d66334f2520aace259d953ae729d093637dba66f55531b23534dc32894b90
Instruction ID: 33b5f8bdf905717844f8ae1e294344e917e7386ed5b6dacbb0d7492dae5011a4
Opcode Fuzzy Hash: 264d66334f2520aace259d953ae729d093637dba66f55531b23534dc32894b90
Instruction Fuzzy Hash: A3314FB1A087059FD700EFB9D89435EFBF5AF85320F118A2DE5A89B390D77484499F82

Function 0096B104 Relevance: 13.6, APIs: 9, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00969998: GetModuleHandleW.KERNEL32(?,?,00000000,00000001,?,?,009683D3), ref: 009699AC
Part of subcall function 00969998: FindResourceW.KERNEL32 ref: 009699C4

GlobalAlloc.KERNEL32 ref: 0096B132
GlobalLock.KERNEL32 ref: 0096B148
GlobalFree.KERNEL32 ref: 0096B15B
GlobalUnlock.KERNEL32 ref: 0096B177
CreateStreamOnHGlobal.OLE32(00000000), ref: 0096B193
GlobalFree.KERNEL32 ref: 0096B1A6

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Global$Free$AllocCreateFindHandleLockModuleResourceStreamUnlock
String ID:
API String ID: 785323675-0
Opcode ID: 5335ed9bc3539fc7583bed1e95e0f4d6058d3296d3554fae421ee05aa25bf1f5
Instruction ID: 21e614cedb76ca95855d1d9432f44ef91db4b955a503956a6187389850f837bd
Opcode Fuzzy Hash: 5335ed9bc3539fc7583bed1e95e0f4d6058d3296d3554fae421ee05aa25bf1f5
Instruction Fuzzy Hash: 0C31DBB59142089FDB04EFA8C98479EBBF8FF88310F15852AE958E7211E7749884DF61

Function 0096B55C Relevance: 7.5, APIs: 5, Instructions: 43
synchronizationthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 0096B579
GetExitCodeThread.KERNEL32 ref: 0096B58F
CloseHandle.KERNEL32(00000000,00000000), ref: 0096B59A

Part of subcall function 00969144: HeapFree.KERNEL32 ref: 00969241
Part of subcall function 00969144: HeapFree.KERNEL32 ref: 0096925D
Part of subcall function 00969144: CloseHandle.KERNEL32 ref: 0096926F
Part of subcall function 00969144: HeapFree.KERNEL32 ref: 0096928A

GetLastError.KERNEL32 ref: 0096B5BF
SendMessageW.USER32 ref: 0096B5EE

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap$CloseHandle$CodeErrorExitLastMessageObjectSendSingleThreadWait
String ID:
API String ID: 426020348-0
Opcode ID: d2007889759cf61f64ec77f4f1c95cca1517572d27a9a98878abc54a7d1efa3d
Instruction ID: 089a9dcf8acbdaa9c4df9c2e7376322b9c75b98e454815ecb5389c05d215e9fc
Opcode Fuzzy Hash: d2007889759cf61f64ec77f4f1c95cca1517572d27a9a98878abc54a7d1efa3d
Instruction Fuzzy Hash: B9111BB05283059FD700AF65D888B9EBBF8FF08304F40846DF58987261D774A884DF52

Function 00969BD4 Relevance: 6.1, APIs: 4, Instructions: 94
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0096ABB8: strlen.MSVCRT ref: 0096ABD2
Part of subcall function 0096ABB8: HeapAlloc.KERNEL32 ref: 0096AC34
Part of subcall function 0096ABB8: MultiByteToWideChar.KERNEL32 ref: 0096AC68
Part of subcall function 0096ABB8: HeapFree.KERNEL32 ref: 0096AC8B

strlen.MSVCRT ref: 00969C26
CreateDirectoryW.KERNEL32 ref: 00969CA3
GetLastError.KERNEL32 ref: 00969CBC
HeapFree.KERNEL32 ref: 00969CEC

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Freestrlen$AllocByteCharCreateDirectoryErrorLastMultiWide
String ID:
API String ID: 896362570-0
Opcode ID: 7ad335adeb04016406fd6fc77827ae7c04ffc7a61a0b909f88de8eb917a7c609
Instruction ID: f8a9b226736cea974348c54685e0c90136e295ee4c9c379fa62966831dbd7458
Opcode Fuzzy Hash: 7ad335adeb04016406fd6fc77827ae7c04ffc7a61a0b909f88de8eb917a7c609
Instruction Fuzzy Hash: E23103715143098ADB20AB78C9C83AABBEDEB51750F448569D5DCCB290E3794D86C782

Function 009612A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 009612FB
strlen.MSVCRT ref: 0096132B
malloc.MSVCRT ref: 00961336
memcpy.MSVCRT ref: 0096134C

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 0126c7df245aaadc170a26663dbaa9f697342f6528564ad3705aaef683f81c3c
Instruction ID: 7c4529f21a5a8c26c9f9b840d9b731aa3fd21b81dc3a7636ae11e3379a74fefa
Opcode Fuzzy Hash: 0126c7df245aaadc170a26663dbaa9f697342f6528564ad3705aaef683f81c3c
Instruction Fuzzy Hash: 983156B6A183458FCB10DF68D98079DBBF1FB49300F188529D948D7311E734A985EF81

Function 009613C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 009612FB
strlen.MSVCRT ref: 0096132B
malloc.MSVCRT ref: 00961336
memcpy.MSVCRT ref: 0096134C

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 13b2511d7bfb41389ffafccbffdb825ee3e69ebf04d98313c3fa247bf9b0659d
Instruction ID: 8b8806d62ddc54f74a72218e93e5dacb7e9c8b24ea617343bcb62a290a7ce523
Opcode Fuzzy Hash: 13b2511d7bfb41389ffafccbffdb825ee3e69ebf04d98313c3fa247bf9b0659d
Instruction Fuzzy Hash: F621F4B6E18345CFCB14DF69D88069DB7F1FB88300B14892EE94897321E734A981EF81

Function 0096B220 Relevance: 4.6, APIs: 3, Instructions: 50
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 0096B242
GdipGetImageWidth.GDIPLUS ref: 0096B265
GdipGetImageHeight.GDIPLUS ref: 0096B28A

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Gdip$Image$BitmapCreateFromHeightWidth
String ID:
API String ID: 827228198-0
Opcode ID: d5384ace18526dfa02fc9ed9e983848a8f41f5692bbe84d4d7d6a49b42c56bb1
Instruction ID: af313d93eef53dd44a409c064a90f684efc0687a08c5f335c7e3b02e16a9911c
Opcode Fuzzy Hash: d5384ace18526dfa02fc9ed9e983848a8f41f5692bbe84d4d7d6a49b42c56bb1
Instruction Fuzzy Hash: 1711D6B1D042069FDB10DFA9C4846AEFBF8EF88340F04C42AE858DB205E774D841CBA1

Function 00969DB8 Relevance: 3.1, APIs: 2, Instructions: 88filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0096ABB8: strlen.MSVCRT ref: 0096ABD2
Part of subcall function 0096ABB8: HeapAlloc.KERNEL32 ref: 0096AC34
Part of subcall function 0096ABB8: MultiByteToWideChar.KERNEL32 ref: 0096AC68
Part of subcall function 0096ABB8: HeapFree.KERNEL32 ref: 0096AC8B

CreateFileW.KERNEL32 ref: 00969EB6
HeapFree.KERNEL32 ref: 00969EE5

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharCreateFileMultiWidestrlen
String ID:
API String ID: 4054799010-0
Opcode ID: a7e9d9afcfe5191bdec88f5a9a80d6ac318a14da8609f1927ff2c37c0004b2f7
Instruction ID: 090c6658b9879c2a3ab8430688c59856d40bb3338da1a1ab2b8de1cb6babd9a8
Opcode Fuzzy Hash: a7e9d9afcfe5191bdec88f5a9a80d6ac318a14da8609f1927ff2c37c0004b2f7
Instruction Fuzzy Hash: FC31E771E042048BDB11DF69D98839EB7F9EBC4310F2486AAE418D7294D7758E44CF81

Function 00969A14 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,0096D008,?,?,0096B07B), ref: 00969A31
CreateWindowExW.USER32 ref: 00969AAF

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: CreateHandleModuleWindow
String ID:
API String ID: 1178124398-0
Opcode ID: b374af2748d65ab01d577b0c17cb5a9d15616e142a6fd78ee21aac6125dfebf7
Instruction ID: a89b44eeb50545ca2c6b85a5ece8a0dab0d7f2ad4de691ae79a4b38b70943786
Opcode Fuzzy Hash: b374af2748d65ab01d577b0c17cb5a9d15616e142a6fd78ee21aac6125dfebf7
Instruction Fuzzy Hash: 521136B5A293119FC704CF69D98060AFBE8FB8C320F10892EF898D7350D370E9508B92

Function 0096AEFC Relevance: 3.0, APIs: 2, Instructions: 40memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0096ABB8: strlen.MSVCRT ref: 0096ABD2
Part of subcall function 0096ABB8: HeapAlloc.KERNEL32 ref: 0096AC34
Part of subcall function 0096ABB8: MultiByteToWideChar.KERNEL32 ref: 0096AC68
Part of subcall function 0096ABB8: HeapFree.KERNEL32 ref: 0096AC8B

SendMessageW.USER32 ref: 0096AF57
HeapFree.KERNEL32 ref: 0096AF78

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharMessageMultiSendWidestrlen
String ID:
API String ID: 2843101947-0
Opcode ID: 383ce0a66f8499b65f34e9e7e2c9cfc0838a98487df87bff32b3440276f75139
Instruction ID: 6c3a1f6ad7e47e59ac7549ac6ba4720e85bd028118d95a3604d0aa74e95b6ed3
Opcode Fuzzy Hash: 383ce0a66f8499b65f34e9e7e2c9cfc0838a98487df87bff32b3440276f75139
Instruction Fuzzy Hash: 7A0171B59043049BD710AF6DE98879DBBF4EB84310F10856DE84897350D7714944CF92

Function 00969F00 Relevance: 3.0, APIs: 2, Instructions: 31filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0096ABB8: strlen.MSVCRT ref: 0096ABD2
Part of subcall function 0096ABB8: HeapAlloc.KERNEL32 ref: 0096AC34
Part of subcall function 0096ABB8: MultiByteToWideChar.KERNEL32 ref: 0096AC68
Part of subcall function 0096ABB8: HeapFree.KERNEL32 ref: 0096AC8B

DeleteFileW.KERNEL32 ref: 00969F3A
HeapFree.KERNEL32 ref: 00969F59

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharDeleteFileMultiWidestrlen
String ID:
API String ID: 3068648626-0
Opcode ID: 0055d139e6f397b6bcbbeccdd14f34e603a04872426188295a2c85e930fe10d7
Instruction ID: 29818709683ce30fdbe0e85fd6effd5a7a4089d5a8fca798f8cff35967d9e21a
Opcode Fuzzy Hash: 0055d139e6f397b6bcbbeccdd14f34e603a04872426188295a2c85e930fe10d7
Instruction Fuzzy Hash: 05F054B1915315DBCB10AFB8ED8C69EBBBCEB04710F008659E598D7291D77159848FC1

Function 0096ADDC Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00968668), ref: 0096AE00
LoadImageW.USER32 ref: 0096AE2A

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: HandleImageLoadModule
String ID:
API String ID: 2603579926-0
Opcode ID: 994bc5d94890bc8aec479e349174573691bbb789308724cb2bacc618fdb42a83
Instruction ID: f57d146ef5b6440a1744361483be637e4aff8a3e4ffde4a8bb518210bd08dc80
Opcode Fuzzy Hash: 994bc5d94890bc8aec479e349174573691bbb789308724cb2bacc618fdb42a83
Instruction Fuzzy Hash: 66F012B19183049BD700AF69E94939AFBF4FB88354F00892DE9D883350D7B555948B92

Function 009698B4 Relevance: 1.6, APIs: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 0096992A

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3b84916beb6ca7bbb0da32ad983b3c71ae8380abe7ea61d78925135533ae1f5c
Instruction ID: b30d66446f1ae4a1d616b44b315f51caf332e7e1dc53df95e57c07e6cdfc436b
Opcode Fuzzy Hash: 3b84916beb6ca7bbb0da32ad983b3c71ae8380abe7ea61d78925135533ae1f5c
Instruction Fuzzy Hash: 3C215C71A043009FDB009F69D48469EBBE8FB88364F108A2EE5689B294D7799801CF92

Function 0096B020 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32 ref: 0096B04F

Part of subcall function 00969A14: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,0096D008,?,?,0096B07B), ref: 00969A31
Part of subcall function 00969A14: CreateWindowExW.USER32 ref: 00969AAF

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Create$BrushHandleModuleSolidWindow
String ID:
API String ID: 1662306801-0
Opcode ID: 04191a79949195ca90c1f958623d7ee02fff2047c1c2edb7964082c870ae34e7
Instruction ID: ae69dee27d588f3e7c081fe2a16fe441f199468560937eda88a48b7c771d5b53
Opcode Fuzzy Hash: 04191a79949195ca90c1f958623d7ee02fff2047c1c2edb7964082c870ae34e7
Instruction Fuzzy Hash: F4F0E0B19003049BDB10DF66D8447DABFF4FF84724F00402DE9489B291D7B59484C761

Function 00968C90 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00968CB6

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: d46b55232f8d1d3818c10540977efd6ea32f5f738acb1ab3108767da4d499d04
Instruction ID: f49e52aec382ff4873665522c944a702e213d42d414d584b02bedecbeb58b89e
Opcode Fuzzy Hash: d46b55232f8d1d3818c10540977efd6ea32f5f738acb1ab3108767da4d499d04
Instruction Fuzzy Hash: 4AE0EDB0504300DFD700DF28D689706BBF4AB04308F048458D8488B355D3B4D944CB51

Function 00969B84 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00969B91

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 1b6b4a49818362832c93dce2a13d75510bb9af8dc27697fe666a996c876aae41
Instruction ID: 3346ee1206caadea4b7f2875e5cca28cdd2a1e5a02026810340efa2e1d5f0535
Opcode Fuzzy Hash: 1b6b4a49818362832c93dce2a13d75510bb9af8dc27697fe666a996c876aae41
Instruction Fuzzy Hash: 60F0A71161C2E85FDF2532B864C127ABBDC4B5E200B0809F5D496CB349E4B588444396

Non-executed Functions

Function 009693D8 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 268windowstringCOMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 0096941D

Part of subcall function 0096B020: CreateSolidBrush.GDI32 ref: 0096B04F

GetWindowLongW.USER32 ref: 0096945E
SetWindowLongW.USER32 ref: 00969482

Part of subcall function 0096AEFC: SendMessageW.USER32 ref: 0096AF57
Part of subcall function 0096AEFC: HeapFree.KERNEL32 ref: 0096AF78

Part of subcall function 0096AE88: SetWindowPos.USER32 ref: 0096AEEB

ShowWindow.USER32 ref: 00969514

Part of subcall function 0096ADDC: GetModuleHandleW.KERNEL32(?,?,?,00968668), ref: 0096AE00
Part of subcall function 0096ADDC: LoadImageW.USER32 ref: 0096AE2A

SendMessageW.USER32(00000000,00000000), ref: 0096955D
SendMessageW.USER32 ref: 00969588

Part of subcall function 0096AD58: MultiByteToWideChar.KERNEL32 ref: 0096ADA4

CreateFontIndirectW.GDI32 ref: 009695AA
CreateSolidBrush.GDI32(?), ref: 009695C5
LoadImageW.USER32 ref: 00969671
SendMessageW.USER32 ref: 0096969C
ShowWindow.USER32 ref: 009696C1
strlen.MSVCRT ref: 009696DA
ShowWindow.USER32(00000000,00000000), ref: 00969732
LoadCursorW.USER32(00000000,00000000), ref: 00969757
SetWindowLongW.USER32 ref: 0096978D
CreateFontIndirectW.GDI32 ref: 00969816
SendMessageW.USER32 ref: 0096984B
strlen.MSVCRT ref: 00969874
ShowWindow.USER32 ref: 009698A6

Strings

An error has occurred during the installation.Please try downloading the installer manually., xrefs: 009693E4
Download AdGuard VPN, xrefs: 00969851
AdGuard VPN Web Installer, xrefs: 00969499
0, xrefs: 00969836

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Window$MessageSend$CreateShow$LoadLong$BrushFontImageIndirectSolidstrlen$ByteCharCursorFreeHandleHeapInfoLocaleModuleMultiWide
String ID: 0$AdGuard VPN Web Installer$An error has occurred during the installation.Please try downloading the installer manually.$Download AdGuard VPN
API String ID: 3353892530-2983585088
Opcode ID: 085978034bd71d83b20e1c6c95656ae5b1171c5b87d8a6bbb4a4c5b4be5a2bbe
Instruction ID: 40dc2e5917966b6310d00cbcf31ec5b4da15cf34e68eab1afd8b934e00f278be
Opcode Fuzzy Hash: 085978034bd71d83b20e1c6c95656ae5b1171c5b87d8a6bbb4a4c5b4be5a2bbe
Instruction Fuzzy Hash: 45D14A71A183058FD710EF29C88479ABBF0FF84314F04896DE8989B365D775A984DF92

Function 009614F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00961500
LoadLibraryA.KERNEL32 ref: 00961516
GetProcAddress.KERNEL32 ref: 00961535
GetProcAddress.KERNEL32 ref: 00961547

Strings

__register_frame_info, xrefs: 0096152A
libgcc_s_dw2-1.dll, xrefs: 009614F9, 0096150F
__deregister_frame_info, xrefs: 0096153C

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: f9fa514e8872ba535f7e2d32b537b77e1b0265fec51dbd999d1cb66e09348c36
Instruction ID: 9e49dfef7740bd2666bb9a3202f77113bebea06f937eef3818165d48df3dba9b
Opcode Fuzzy Hash: f9fa514e8872ba535f7e2d32b537b77e1b0265fec51dbd999d1cb66e09348c36
Instruction Fuzzy Hash: C40121B692D3009FC720BF79AA49219BFF4EB84751F05482EE58987210E7B49488DBD3

Function 00965010 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1481COMMON

Download Yara Rule

Strings

NaN, xrefs: 009650DF
Infinity, xrefs: 00965340
, xrefs: 00966786
, xrefs: 009664EE
9, xrefs: 009665AB

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: $ $9$Infinity$NaN
API String ID: 0-2156819404
Opcode ID: ae4fd836903be7ce215965df18d3cbe5e344ff8d846cf7ac650b2028e2ff1277
Instruction ID: 062d8359689c64eab3c81634a9f8d80fa9b9374077bc7482634171ee56406487
Opcode Fuzzy Hash: ae4fd836903be7ce215965df18d3cbe5e344ff8d846cf7ac650b2028e2ff1277
Instruction Fuzzy Hash: E9D221B1A087818FD720DF69C08475AFBE1BB88354F658D1EE89987361E7B5D844CF82

Function 00963D60 Relevance: 7.9, Strings: 6, Instructions: 417COMMON

Download Yara Rule

Strings

@, xrefs: 00963ECC
NaN, xrefs: 009640C2
., xrefs: 00963DFD
gfff, xrefs: 00963E35
gfff, xrefs: 00963E70
Inf, xrefs: 009642AC

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: 51103e7c62dfb217e876594ac56c9d1d74ec26d744444984ce7df37d1b640c0b
Instruction ID: 98bb662746fe701e5475338e527a09d6c29c77a696e3a0d8711801217d35873d
Opcode Fuzzy Hash: 51103e7c62dfb217e876594ac56c9d1d74ec26d744444984ce7df37d1b640c0b
Instruction Fuzzy Hash: 74E1FE71A087018BD7149F69C48432BFBE1AFC8304F188A2EF999CB385E675DD45CB92

Function 009618C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 009618EF
vfprintf.MSVCRT ref: 0096190F
abort.MSVCRT ref: 00961914
VirtualQuery.KERNEL32 ref: 009619AB

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00961A57
Mingw-w64 runtime failure:, xrefs: 009618E8
Address %p has no image-section, xrefs: 00961A6B
VirtualProtect failed with code 0x%x, xrefs: 00961A26

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: 241daf64e9782f5c845cf058565a3612a9cf2a83ef6fa4fec674939f5d36f24d
Instruction ID: 3462919a3705e0a885ea5708cd231c646e1c64358d26635adfe634d5ea773d44
Opcode Fuzzy Hash: 241daf64e9782f5c845cf058565a3612a9cf2a83ef6fa4fec674939f5d36f24d
Instruction Fuzzy Hash: E4516BB29193018FCB10EF68D88575AFBE4FFC4354F49892DE4888B215E734E884CB92

Function 00961D50 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00961D8F
signal.MSVCRT ref: 00961DD6
signal.MSVCRT ref: 00961DEF
signal.MSVCRT ref: 00961E16
signal.MSVCRT ref: 00961E5A

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: cc64b58ed6b42b79dd0db560176faac6c3e7fd805e615f4de5d0da3af43f019a
Instruction ID: 84bfb87393116e67fc1038b96c603495c1d10878a0121cffaa75ea6856ac9777
Opcode Fuzzy Hash: cc64b58ed6b42b79dd0db560176faac6c3e7fd805e615f4de5d0da3af43f019a
Instruction Fuzzy Hash: 953121B05082018AE7616F78C65432EB6E8BB91368F194F0AE9E4C73D1CB7EC884D753

Function 00962AB0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 395COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00962C60
memset.MSVCRT ref: 00962D7F

Strings

o, xrefs: 00962FC8
0, xrefs: 00962FA7

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: fputcmemset
String ID: 0$o
API String ID: 947785774-4157579757
Opcode ID: 8e0685638adb49ae4f37e01c505298bd78bdcd604d7e6113846537aeeb44b7b6
Instruction ID: dc037da3e94f865de20ee1cd69b687b0dd5237488773cb36acaefad319e756d9
Opcode Fuzzy Hash: 8e0685638adb49ae4f37e01c505298bd78bdcd604d7e6113846537aeeb44b7b6
Instruction Fuzzy Hash: FFF16F72E04A198FDB14CF68C49039DBBF5BF84354F298669E895EB385D335E842CB90

Function 00967E61 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00967E6C
GetProcAddress.KERNEL32 ref: 00967E8C
GetProcAddress.KERNEL32 ref: 00967ECB

Strings

___lc_codepage_func, xrefs: 00967E84
__lc_codepage, xrefs: 00967EC0
msvcrt.dll, xrefs: 00967E65

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: 75410a0afcc81b62102bd8fb9adf8f90e62a36d8e86e56ce49b280a476a4e1fe
Instruction ID: c0e6cd4432306d84493f9a9b538d1fa65f712a15c0385269c1713d9e4365c635
Opcode Fuzzy Hash: 75410a0afcc81b62102bd8fb9adf8f90e62a36d8e86e56ce49b280a476a4e1fe
Instruction Fuzzy Hash: 01F05BB593D3008FC711BFBC6E45119BBE4B608314F05097ED885D7251E775D898D792

Function 00963050 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

0, xrefs: 009633FA

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 906d0336041f0955854ea0fe103f6f14ae2e15edb6cc9c825826e81eb6b08927
Instruction ID: f1302bf02ec751cae8c7551addc3b5274d963fa9e8c54649b034851217c99a38
Opcode Fuzzy Hash: 906d0336041f0955854ea0fe103f6f14ae2e15edb6cc9c825826e81eb6b08927
Instruction Fuzzy Hash: DEB18671E042058BDB14CF68C49479ABBF5AF89304F29C669EC59AF386D734EE01CB90

Function 00963183 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 009631BD
fputc.MSVCRT ref: 00963277
fputc.MSVCRT ref: 009632D1

Strings

0, xrefs: 009631AE

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: fputc$memset
String ID: 0
API String ID: 2944404495-4108050209
Opcode ID: 0ae888e68ee06ac94637e7e2c572a203338626a9d5973659b47df7a582a49451
Instruction ID: 42c82919f3c53cdad62322e82551f51197a799a718755798ba4eb1f5e0e532f9
Opcode Fuzzy Hash: 0ae888e68ee06ac94637e7e2c572a203338626a9d5973659b47df7a582a49451
Instruction Fuzzy Hash: C7315871E052118BDB04CFA8C29475ABBF6BF88340F25C569ED58AB34AD734EE00CB80

Function 009633CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00963277
fputc.MSVCRT ref: 009632D1
memset.MSVCRT ref: 00963405

Strings

0, xrefs: 009633FA

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: fputc$memset
String ID: 0
API String ID: 2944404495-4108050209
Opcode ID: cf32a4d500d49d76f558de93517f77d76bc5c35e592a36b3ebc26798908fe853
Instruction ID: 7d6f8741cd397da44a6255a59c76ab8acfa6b43178d1b28466bb8979a4a0e456
Opcode Fuzzy Hash: cf32a4d500d49d76f558de93517f77d76bc5c35e592a36b3ebc26798908fe853
Instruction Fuzzy Hash: 3C217FB1904201CBDB14CF68C1E4355BBE6BF88350F25C659D9A99F38AD334EE01CB80

Function 00967E18 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00967E32
strchr.MSVCRT ref: 00967E42
atoi.MSVCRT ref: 00967E53

Strings

., xrefs: 00967E37

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction ID: 7a99c39e3aea7a381ee5dd752f19b91c2b528c4551a1d6fb76da6b7cb64f9ad3
Opcode Fuzzy Hash: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction Fuzzy Hash: 8AE0ECB19087004AD7017FB8C50A31AFAE1AB80308F498CACE48887756E77E98499752

Function 0096ABB8 Relevance: 6.3, APIs: 5, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0096ABD2
MultiByteToWideChar.KERNEL32 ref: 0096AC02
HeapAlloc.KERNEL32 ref: 0096AC34
MultiByteToWideChar.KERNEL32 ref: 0096AC68
HeapFree.KERNEL32 ref: 0096AC8B

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: ByteCharHeapMultiWide$AllocFreestrlen
String ID:
API String ID: 998811608-0
Opcode ID: 28fc3ef426a570231488b0d9a8a227f8543d03f4351a18de63e431e2d374d05a
Instruction ID: 6bb9e843e1be4a2cfd5da06045ae0fd5aad0e8637d0226b9c0426a69c819399b
Opcode Fuzzy Hash: 28fc3ef426a570231488b0d9a8a227f8543d03f4351a18de63e431e2d374d05a
Instruction Fuzzy Hash: E13108B19093029FD710EF69D58466ABBF4FF84314F01892EE898D7350E77899499F83

Function 00967820 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00967872
MultiByteToWideChar.KERNEL32 ref: 009678B5

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 59063d6e2a282664db2f6f2aff5c3fb8b3054a33db1eb3cebbd4faf70137f9f0
Instruction ID: 34a2fc2690e237606500061b90bc3bb3d934fd224d351307f4d055de6fb78084
Opcode Fuzzy Hash: 59063d6e2a282664db2f6f2aff5c3fb8b3054a33db1eb3cebbd4faf70137f9f0
Instruction Fuzzy Hash: 7B41F2B151D3418FD710DF68D48865AFBE0BF85318F04896EE8948B391E376D849CB92

Function 00961001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00961075
__p__fmode.MSVCRT ref: 0096107A
__p__commode.MSVCRT ref: 00961087

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: fd56f27cba01db66ef355f04da4a37b3fe9c05c5652451e316ac602c27ad2375
Instruction ID: c1f4f77f2f72eac317037d0f7a2d0ab06eb3de3de385b7b86ac2c3538f362228
Opcode Fuzzy Hash: fd56f27cba01db66ef355f04da4a37b3fe9c05c5652451e316ac602c27ad2375
Instruction Fuzzy Hash: D721727051C281CBCB14AF24C55536677E5FB80384F5C4968C4498B26AD77A98C6EBA1

Function 00961A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00961CD3
Unknown pseudo relocation bit size %d., xrefs: 00961B84

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 970bb46ace53ad71eb6d6a746d76dfbf502230ec39de24de146623b4a52bfb65
Instruction ID: bcf1065ea98e945c89d20e116fe11efeb2ed52feb70cb4b39c16584b729b347a
Opcode Fuzzy Hash: 970bb46ace53ad71eb6d6a746d76dfbf502230ec39de24de146623b4a52bfb65
Instruction Fuzzy Hash: FC71B135A083058BCB14DF79D89069EB7F6FFC4380F598A1AE88997315E730A855CB91

Function 0096AF8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0096ABB8: strlen.MSVCRT ref: 0096ABD2
Part of subcall function 0096ABB8: HeapAlloc.KERNEL32 ref: 0096AC34
Part of subcall function 0096ABB8: MultiByteToWideChar.KERNEL32 ref: 0096AC68
Part of subcall function 0096ABB8: HeapFree.KERNEL32 ref: 0096AC8B

ShellExecuteW.SHELL32 ref: 0096AFEE
HeapFree.KERNEL32 ref: 0096B00F

Strings

open, xrefs: 0096AFDF

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: Heap$Free$AllocByteCharExecuteMultiShellWidestrlen
String ID: open
API String ID: 2746946616-2758837156
Opcode ID: 1c27207b3a7ac59812787be5463d157afe15572153fb8c917bfb33ca020c072d
Instruction ID: fcdd093c92bfae1716c193e23866f2f28c272e57a3f14e2e0493f863186ec160
Opcode Fuzzy Hash: 1c27207b3a7ac59812787be5463d157afe15572153fb8c917bfb33ca020c072d
Instruction Fuzzy Hash: A4016DB19093119FD710AFA8D94838EBFF4EB44314F008A5DE4A897290E7B59988CFD2

Function 00961830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0096189E

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0096187F
Unknown error, xrefs: 00961832

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 438a1095b128f62f5d02ffbcc47db14e3ec25cb72aa5773a7b7653aacc0127da
Instruction ID: 1e8922848ae091b722912d214c8ec2b555af9ee25a71daaeecb8924020f30a0b
Opcode Fuzzy Hash: 438a1095b128f62f5d02ffbcc47db14e3ec25cb72aa5773a7b7653aacc0127da
Instruction Fuzzy Hash: F901D2B4408B45CBD300AF15E48851AFFF1FF89364F86889CF5C4462A9DB3298A8CB46

Function 0096AE3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00969AC0: SetWindowLongW.USER32 ref: 00969B24

SendMessageW.USER32 ref: 0096AE78

Strings

An error has occurred during the installation.Please try downloading the installer manually., xrefs: 0096AE42
0, xrefs: 0096AE6D

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: LongMessageSendWindow
String ID: 0$An error has occurred during the installation.Please try downloading the installer manually.
API String ID: 3360111000-109714329
Opcode ID: c3bf5e7f98de48e6175d9b901715f0b64f835abac63cff9941b76432f8bd156f
Instruction ID: 4a589411c294b7d6acbe2dc6b98a457fcff2b7e52587d37e65af8ae1db4b1cb1
Opcode Fuzzy Hash: c3bf5e7f98de48e6175d9b901715f0b64f835abac63cff9941b76432f8bd156f
Instruction Fuzzy Hash: 53F06D71A143109FEB00AFB9D88576ABBECEB84364F40846DE968C7341E731D844CBD2

Function 00966940 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,00966A71,?,?,?,?,?,?,00000000,00964D84), ref: 00966967
InitializeCriticalSection.KERNEL32(?,?,?,?,00966A71,?,?,?,?,?,?,00000000,00964D84), ref: 009669A4
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00966A71,?,?,?,?,?,?,00000000,00964D84), ref: 009669B0
EnterCriticalSection.KERNEL32(?,?,?,?,00966A71,?,?,?,?,?,?,00000000,00964D84), ref: 009669D8

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: c71411512dc13aad8f06ebcd56cb4e780cc80890b32d9d1eac871edcd145e31b
Instruction ID: 8306a6a61f8aee410d4ad914e76e102ebaedafeab20f9111b11569ed513b5649
Opcode Fuzzy Hash: c71411512dc13aad8f06ebcd56cb4e780cc80890b32d9d1eac871edcd145e31b
Instruction Fuzzy Hash: 261165B28292408BD724AB2CEAC626A7BF8EB00340F154925C88EC7225E775D8C4D796

Function 00961F00 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,009620CB,?,?,?,?,?,00961768), ref: 00961F0E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,009620CB,?,?,?,?,?,00961768), ref: 00961F35
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,009620CB,?,?,?,?,?,00961768), ref: 00961F3C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,009620CB,?,?,?,?,?,00961768), ref: 00961F5C

Memory Dump Source

Source File: 00000000.00000002.1947717632.0000000000961000.00000020.00000001.01000000.00000003.sdmp, Offset: 00960000, based on PE: true

Associated: 00000000.00000002.1947699807.0000000000960000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947735033.000000000096D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947752277.000000000096E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947772098.0000000000972000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000973000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947786023.0000000000976000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1947826067.000000000097F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_960000_SecuriteInfo.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 1b5aa3fd09af85a9243f9ea9f29686a5dc2a61bdec5104b107ca25547a5dd90e
Instruction ID: 28613479fa28283d4f8524ecd79c5d4b4f96515f23f99af824861adb0d0aa621
Opcode Fuzzy Hash: 1b5aa3fd09af85a9243f9ea9f29686a5dc2a61bdec5104b107ca25547a5dd90e
Instruction Fuzzy Hash: CDF068B76143508FD720BF79DD8451ABBA8EA54744B090169ED8C8B319E734A889CBA2

Analysis Process: setup.exePID: 732, Parent PID: 7080COMMON

Executed Functions

Function 003D51D2 Relevance: 38.8, APIs: 5, Strings: 17, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 003D5254

Part of subcall function 0040FDC4: InitializeCriticalSection.KERNEL32(0043B5D4,?,003D5260,00000000,?,?,?,?,?,?), ref: 0040FDDB

Part of subcall function 003D1206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,003D527C,00000000,?), ref: 003D1244
Part of subcall function 003D1206: GetLastError.KERNEL32(?,?,?,003D527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 003D124E

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 003D52C2

Part of subcall function 004106C0: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 004106E1

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 003D5354
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 003D535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D55CB

Strings

c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 003D5382
Failed to run untrusted mode., xrefs: 003D54F3
Failed to initialize COM., xrefs: 003D52CE
Failed to initialize Wiutil., xrefs: 003D531E
Failed to initialize core., xrefs: 003D5400
Failed to parse command line., xrefs: 003D5282
3.11.2.4516, xrefs: 003D53C1
Failed to run per-user mode., xrefs: 003D54D1
Failed to initialize Regutil., xrefs: 003D5306
Failed to initialize engine state., xrefs: 003D52A9
Failed to get OS info., xrefs: 003D538C
Failed to run RunOnce mode., xrefs: 003D5459
Failed to initialize Cryputil., xrefs: 003D52E3
Invalid run mode., xrefs: 003D5436
Failed to initialize XML util., xrefs: 003D5336
Failed to run embedded mode., xrefs: 003D5481
Failed to run per-machine mode., xrefs: 003D54A9

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.2.4516$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3262001429-313893568
Opcode ID: c77cc1d0e2ffb3771f1e1fdd2edb83fb53244fb41815987ce397776195dd5220
Instruction ID: 72019e8d99405225e8677a84928deb8864233ae835138199bfd90f4f15078166
Opcode Fuzzy Hash: c77cc1d0e2ffb3771f1e1fdd2edb83fb53244fb41815987ce397776195dd5220
Instruction Fuzzy Hash: 1CB1E373D41A299BDB33AF65AC45BED76B9AF08300F1101A7F908B6341DB349E94CE85

Function 004128BD Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00412E6B,00000000,?,00000000), ref: 004128D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,BT=,003FBD14,0041A518,BT=,?,00000000,?), ref: 004128E3
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00412923
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0041292F
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 0041293A
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00412944
CoCreateInstance.OLE32(0043B688,00000000,00000001,0041A878,?,?,?,?,?,?,?,?,?,?,BT=,003FBD14), ref: 0041297F
ExitProcess.KERNEL32 ref: 00412A2E

Strings

Wow64DisableWow64FsRedirection, xrefs: 00412929
Wow64RevertWow64FsRedirection, xrefs: 0041293C
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00412907
kernel32.dll, xrefs: 004128C7
Wow64EnableWow64FsRedirection, xrefs: 00412931
IsWow64Process, xrefs: 0041291D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-3734847636
Opcode ID: 256c40f1465aee15d99aaa5ff544aed9b2297f9ef4b41eb9edca3ec21cfacd2d
Instruction ID: 4d94c35c2591820c5724fa3af0abf77b17e13778e84e5cc2ea23673f2688f049
Opcode Fuzzy Hash: 256c40f1465aee15d99aaa5ff544aed9b2297f9ef4b41eb9edca3ec21cfacd2d
Instruction Fuzzy Hash: 2B41D271B01315ABCB219BA8C945FEFB7A4EF08750F11406AE901F7341D7B9DEA18B98

Function 003D1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003D34C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,003D10DD,?,00000000), ref: 003D34E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 003D10F6

Part of subcall function 003D1173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D1184
Part of subcall function 003D1173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D118F
Part of subcall function 003D1173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 003D119D
Part of subcall function 003D1173: GetLastError.KERNEL32(?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D11B8
Part of subcall function 003D1173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 003D11C0
Part of subcall function 003D1173: GetLastError.KERNEL32(?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D11D5

CloseHandle.KERNEL32(?,?,?,?,0041A4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 003D1131

Strings

wininet.dll, xrefs: 003D10AE
clbcatq.dll, xrefs: 003D10BC
comres.dll, xrefs: 003D10B5
crypt32.dll, xrefs: 003D10CA
msi.dll, xrefs: 003D10A0
msasn1.dll, xrefs: 003D10C3
feclient.dll, xrefs: 003D10D1
cabinet.dll, xrefs: 003D1099, 003D1114
version.dll, xrefs: 003D10A7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: 44ad06b2f0a3e0626033bc0598088cc72eb461290682ec47cfca31a7f86d02ec
Instruction ID: eeccf7dcf9228e0caf83f243359df89ea0f919ac540e87faa1a96085b9b19e63
Opcode Fuzzy Hash: 44ad06b2f0a3e0626033bc0598088cc72eb461290682ec47cfca31a7f86d02ec
Instruction Fuzzy Hash: D821A872901218BBDB11DFA4EC09BDEBBB8EF44714F108116F611BB281D7B459548BA5

Function 003E9F8F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed to calculate working folder to ensure it exists., xrefs: 003E9FAC
Failed create working folder., xrefs: 003E9FC2
Failed to copy working folder., xrefs: 003E9FEA

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: 1474a1b9da6cda21f0ae561b74d9f1128179596482e8018e49f9e2184c9dd688
Instruction ID: b6c41401a958a80296456b63b8d66d6563dcee0d586f77a0274ae562cee151dc
Opcode Fuzzy Hash: 1474a1b9da6cda21f0ae561b74d9f1128179596482e8018e49f9e2184c9dd688
Instruction Fuzzy Hash: 9701D832905574FB8B236B56DD05D9EBB79DF507217214227F800F9254DA358F41A780

Function 003DDEDC Relevance: 130.1, APIs: 11, Strings: 63, Instructions: 648COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 003DE001
SysFreeString.OLEAUT32(00000000), ref: 003DE6E5

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

Strings

Failed to parse dependency providers., xrefs: 003DE659
crypt32.dll, xrefs: 003DE264
Failed to find forward transaction boundary: %ls, xrefs: 003DE4AF
Failed to get @RollbackBoundaryBackward., xrefs: 003DE4D0
always, xrefs: 003DE150
Invalid cache type: %ls, xrefs: 003DE699
Failed to get @InstallCondition., xrefs: 003DE4A2
Failed to get @RollbackLogPathVariable., xrefs: 003DE498
Cache, xrefs: 003DE0F4
Failed to get @Vital., xrefs: 003DE667
Failed to allocate memory for package structs., xrefs: 003DE098
CacheId, xrefs: 003DE172
comres.dll, xrefs: 003DE1DD
Failed to select package nodes., xrefs: 003DE03D
`<u, xrefs: 003DE001, 003DE424, 003DE6E5
Size, xrefs: 003DE18D
MsiPackage, xrefs: 003DE33E
c:\agent\_work\66\s\src\burn\engine\package.cpp, xrefs: 003DDF67, 003DE08C, 003DE478, 003DE50D
wininet.dll, xrefs: 003DE203
Failed to allocate memory for MSP patch sequence information., xrefs: 003DE484
Failed to parse MSU package., xrefs: 003DE4E4
Failed to allocate memory for patch sequence information to package lookup., xrefs: 003DE519
RollbackBoundaryForward, xrefs: 003DE288
Failed to get next node., xrefs: 003DE6B7
Permanent, xrefs: 003DE1DE
Failed to get @CacheId., xrefs: 003DE68A
MsuPackage, xrefs: 003DE3AF
Failed to parse MSI package., xrefs: 003DE36A
Failed to get @Id., xrefs: 003DE6B0
Failed to get @InstallSize., xrefs: 003DE67C
Failed to get @Size., xrefs: 003DE683
MspPackage, xrefs: 003DE376
cabinet.dll, xrefs: 003DE1A7
RollbackBoundary, xrefs: 003DDEFF
Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage, xrefs: 003DE02A
Failed to find backward transaction boundary: %ls, xrefs: 003DE4C6
Failed to select rollback boundary nodes., xrefs: 003DDF12
Vital, xrefs: 003DDFD0, 003DE204
InstallCondition, xrefs: 003DE265
InstallSize, xrefs: 003DE1A8
Failed to get @PerMachine., xrefs: 003DE675
msi.dll, xrefs: 003DE171
msasn1.dll, xrefs: 003DDF45
Failed to get @Permanent., xrefs: 003DE66E
Failed to get @Cache., xrefs: 003DE6A9
RollbackLogPathVariable, xrefs: 003DE242
Failed to parse MSP package., xrefs: 003DE4DA
Failed to get rollback bundary node count., xrefs: 003DDF37
ExePackage, xrefs: 003DE300
BT=, xrefs: 003DDEDC
clbcatq.dll, xrefs: 003DE1C2
Failed to get @RollbackBoundaryForward., xrefs: 003DE4B9
RollbackBoundaryBackward, xrefs: 003DE2C2
feclient.dll, xrefs: 003DE241
PerMachine, xrefs: 003DE1C3
Failed to get package node count., xrefs: 003DE05A
yes, xrefs: 003DE130
Failed to get @LogPathVariable., xrefs: 003DE48E
Failed to parse EXE package., xrefs: 003DE332
Failed to parse payload references., xrefs: 003DE660
Failed to allocate memory for rollback boundary structs., xrefs: 003DDF73
LogPathVariable, xrefs: 003DE21F
Failed to parse target product codes., xrefs: 003DE64A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: BT=$Cache$CacheId$Chain/ExePackage|Chain/MsiPackage|Chain/MspPackage|Chain/MsuPackage$ExePackage$Failed to allocate memory for MSP patch sequence information.$Failed to allocate memory for package structs.$Failed to allocate memory for patch sequence information to package lookup.$Failed to allocate memory for rollback boundary structs.$Failed to find backward transaction boundary: %ls$Failed to find forward transaction boundary: %ls$Failed to get @Cache.$Failed to get @CacheId.$Failed to get @Id.$Failed to get @InstallCondition.$Failed to get @InstallSize.$Failed to get @LogPathVariable.$Failed to get @PerMachine.$Failed to get @Permanent.$Failed to get @RollbackBoundaryBackward.$Failed to get @RollbackBoundaryForward.$Failed to get @RollbackLogPathVariable.$Failed to get @Size.$Failed to get @Vital.$Failed to get next node.$Failed to get package node count.$Failed to get rollback bundary node count.$Failed to parse EXE package.$Failed to parse MSI package.$Failed to parse MSP package.$Failed to parse MSU package.$Failed to parse dependency providers.$Failed to parse payload references.$Failed to parse target product codes.$Failed to select package nodes.$Failed to select rollback boundary nodes.$InstallCondition$InstallSize$Invalid cache type: %ls$LogPathVariable$MsiPackage$MspPackage$MsuPackage$PerMachine$Permanent$RollbackBoundary$RollbackBoundaryBackward$RollbackBoundaryForward$RollbackLogPathVariable$Size$Vital$`<u$always$c:\agent\_work\66\s\src\burn\engine\package.cpp$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$wininet.dll$yes
API String ID: 336948655-3540708419
Opcode ID: b72aed2746a264d0c9312236d1b07dcc40014d0cc5a6aa6591611dd1b1823886
Instruction ID: 597f042a80041315268f4caabb0ce6950114f2083e8ca89f8033aed937c69bef
Opcode Fuzzy Hash: b72aed2746a264d0c9312236d1b07dcc40014d0cc5a6aa6591611dd1b1823886
Instruction Fuzzy Hash: 1C32C432D04226ABCB12AF64DC41BAEBAB5AF04724F214267F814BF391D774ED419B94

Function 003DF981 Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to set registration paths., xrefs: 003DFEA6
HelpLink, xrefs: 003DFB8B
Failed to get @ProviderKey., xrefs: 003DFA84
Failed to parse related bundles, xrefs: 003DFA21
Failed to get @Classification., xrefs: 003DFE93
Failed to select ARP node., xrefs: 003DFAED
Update, xrefs: 003DFDBC
ParentDisplayName, xrefs: 003DFC1F
Publisher, xrefs: 003DFB66
Manufacturer, xrefs: 003DFDF1
Failed to get @AboutUrl., xrefs: 003DFBEC
Failed to get @HelpTelephone., xrefs: 003DFBC7
Failed to get @Name., xrefs: 003DFE72
Failed to get @DisplayName., xrefs: 003DFB33
Failed to parse software tag., xrefs: 003DFDAE
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 003DFD25
Failed to get @HelpLink., xrefs: 003DFBA2
Version, xrefs: 003DFA2F
Failed to get @Version., xrefs: 003DFA42
DisableRemove, xrefs: 003DFD67
Arp, xrefs: 003DFAD1
Department, xrefs: 003DFE15
Failed to select registration node., xrefs: 003DF9BA
Invalid modify disabled type: %ls, xrefs: 003DFD32
Failed to get @Id., xrefs: 003DF9E7
Comments, xrefs: 003DFC47
button, xrefs: 003DFCB3
Failed to get @DisableModify., xrefs: 003DFD56
Name, xrefs: 003DFE5F
UpdateUrl, xrefs: 003DFBFA
DisplayName, xrefs: 003DFB1C
DisableModify, xrefs: 003DFC94
ProviderKey, xrefs: 003DFA71
Failed to get @Manufacturer., xrefs: 003DFE04
HelpTelephone, xrefs: 003DFBB0
Failed to get @PerMachine., xrefs: 003DFAC3
msasn1.dll, xrefs: 003DF9CC, 003DF9D3
Failed to get @ExecutableName., xrefs: 003DFAA5
Register, xrefs: 003DFAFB
Failed to get @Contact., xrefs: 003DFC86
ProductFamily, xrefs: 003DFE3A
Classification, xrefs: 003DFE80
Failed to get @Publisher., xrefs: 003DFB7D
Failed to select Update node., xrefs: 003DFDDA
Failed to get @Tag., xrefs: 003DFA08
Failed to get @UpdateUrl., xrefs: 003DFC11
ExecutableName, xrefs: 003DFA92
DisplayVersion, xrefs: 003DFB41
BT=, xrefs: 003DF981
Failed to get @DisplayVersion., xrefs: 003DFB58
clbcatq.dll, xrefs: 003DF9F4
Failed to get @Register., xrefs: 003DFB0E
Contact, xrefs: 003DFC6F
AboutUrl, xrefs: 003DFBD5
Failed to get @ParentDisplayName., xrefs: 003DFC36
Failed to get @ProductFamily., xrefs: 003DFE51
Tag, xrefs: 003DF9F5
PerMachine, xrefs: 003DFAB0
Failed to get @Department., xrefs: 003DFE2C
Failed to parse @Version: %ls, xrefs: 003DFA63
Failed to get @DisableRemove., xrefs: 003DFD7E
yes, xrefs: 003DFCD4
Failed to get @Comments., xrefs: 003DFC5E
Registration, xrefs: 003DF99B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$BT=$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\66\s\src\burn\engine\registration.cpp$clbcatq.dll$msasn1.dll$yes
API String ID: 760788290-977585757
Opcode ID: de12877d480856dc12ad2ab14f8610a474ecccdc387ca7a1af6af9bf1f0a06ac
Instruction ID: fc9c9faa4e491b920d7ee8a74df7393268058c8c6531c324f7db9bfdd9080ed8
Opcode Fuzzy Hash: de12877d480856dc12ad2ab14f8610a474ecccdc387ca7a1af6af9bf1f0a06ac
Instruction Fuzzy Hash: 4AE1B533E40636BFCB23AA60FD81FA97B946B04710F610377AC16B73A2D774AD515688

Function 003DB45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 003DB4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB51F
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 003DB525
ReadFile.KERNELBASE(00000000,003D44B0,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB56D
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 003DB573
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB5D6
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB625
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB69C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB6EB
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB73A
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB78C

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB7DF
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB841
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB8D5

Strings

Failed to read section info, unsupported version: %08x, xrefs: 003DB9C4
Failed to seek to section info., xrefs: 003DB6C7, 003DB903
Failed to find valid NT image header in buffer., xrefs: 003DBB9F
Failed to read NT header., xrefs: 003DB650
Failed to allocate memory for container sizes., xrefs: 003DBAA2
4, xrefs: 003DB853
Failed to open handle to engine process path., xrefs: 003DB4FC
burn, xrefs: 003DB807
Failed to seek to start of file., xrefs: 003DB550
Failed to allocate buffer for section info., xrefs: 003DB8B3
Failed to seek to NT header., xrefs: 003DB601
.wix, xrefs: 003DB7FF
Failed to find valid DOS image header in buffer., xrefs: 003DBBBA
Failed to get total size of bundle., xrefs: 003DB9F2
Failed to seek past optional headers., xrefs: 003DB7BA
Failed to read section info, data to short: %u, xrefs: 003DB879
Failed to read section info., xrefs: 003DB968
PE Header from file didn't match PE Header in memory., xrefs: 003DBAE0
Failed to read complete image section header, index: %u, xrefs: 003DBB44
Failed to read complete section info., xrefs: 003DB994
Failed to read DOS header., xrefs: 003DB59E
Failed to read signature size., xrefs: 003DB765
PE, xrefs: 003DB667
(, xrefs: 003DB7EC
Failed to find Burn section., xrefs: 003DBB01
Failed to read image section header, index: %u, xrefs: 003DBB7B
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 003DB4F2, 003DB546, 003DB594, 003DB5F7, 003DB646, 003DB6BD, 003DB70C, 003DB75B, 003DB7B0, 003DB867, 003DB8A7, 003DB8F9, 003DB95E, 003DB988, 003DB9AF, 003DBA96, 003DBAD6, 003DBAF5, 003DBB32, 003DBB70, 003DBB93, 003DBBAE
Failed to read signature offset., xrefs: 003DB716

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3411815225-1671293494
Opcode ID: a9b5961e10687579e01c9ad6df86d42fc419fdde0c79e0ed4da96b85a644c0df
Instruction ID: b3d128643141cd1cc807fbea954b1d91d488c053e3913fc7b451a8acb08deb8b
Opcode Fuzzy Hash: a9b5961e10687579e01c9ad6df86d42fc419fdde0c79e0ed4da96b85a644c0df
Instruction Fuzzy Hash: 5A120677D40235EBDB228A15DC46FEABAA8AF04710F1241A7FD05BB381D7789D408BE5

Function 003F0ABB Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,003F066B,?,?), ref: 003F0ACA
GetLastError.KERNEL32(?,?,?,?,003F066B,?,?), ref: 003F0AD4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,003F066B,?,?), ref: 003F0B19
GetLastError.KERNEL32(?,?,?,?,003F066B,?,?), ref: 003F0B24
ResetEvent.KERNEL32(?,?,?,?,?,003F066B,?,?), ref: 003F0B5C
GetLastError.KERNEL32(?,?,?,?,003F066B,?,?), ref: 003F0B66

Strings

Failed to set end of file., xrefs: 003F0E39
Failed to set operation complete event., xrefs: 003F0B02, 003F0C43
Invalid operation for this state., xrefs: 003F0BC2
Failed to set file pointer to beginning of file., xrefs: 003F0E7D
Failed to create file: %ls, xrefs: 003F0DA6
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F0AF8, 003F0B48, 003F0B8A, 003F0BB6, 003F0C39, 003F0C81, 003F0CC6, 003F0D2E, 003F0D99, 003F0DEA, 003F0E2F, 003F0E73
Failed to set file pointer to end of file., xrefs: 003F0DF4
Failed to allocate buffer for stream., xrefs: 003F0D38
Failed to reset begin operation event., xrefs: 003F0B94, 003F0CD0
Failed to copy stream name: %ls, xrefs: 003F0BF5
Failed to wait for begin operation event., xrefs: 003F0B52, 003F0C8B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-1830388895
Opcode ID: d3e8c6065705c311d785b56907ab470bfcc5235267233f5109f8dd601b3086f8
Instruction ID: 143216f1131759750e15d09c66348f84705a1e06daeea5cb334518a4670382f2
Opcode Fuzzy Hash: d3e8c6065705c311d785b56907ab470bfcc5235267233f5109f8dd601b3086f8
Instruction Fuzzy Hash: 7F913733E8163AB7E22B1AAC5E49B766954BF00B20F134221BF01BF6D3D769DC1095D9

Function 003D4D7A Relevance: 42.2, APIs: 6, Strings: 18, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003D34C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,003D10DD,?,00000000), ref: 003D34E5

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003D4F81
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003D4F90
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003D4F9F
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003D4FAA

Strings

burn.filehandle.self, xrefs: 003D4E86
D, xrefs: 003D4EEA
Failed to get path for current process., xrefs: 003D4DC4
burn.filehandle.attached, xrefs: 003D4E58
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 003D4F2B
Failed to cache to clean room., xrefs: 003D4E03
Failed to allocate parameters for unelevated process., xrefs: 003D4E3B
-%ls="%ls", xrefs: 003D4E27
Failed to allocate full command-line., xrefs: 003D4ECF
burn.clean.room, xrefs: 003D4E1F
"%ls" %ls, xrefs: 003D4EBB
Failed to launch clean room process: %ls, xrefs: 003D4F38
%ls %ls, xrefs: 003D4E96
Failed to append %ls, xrefs: 003D4E5D
T=, xrefs: 003D4F8D
Failed to wait for clean room process: %ls, xrefs: 003D4F64
Failed to append original command line., xrefs: 003D4EAA
T=, xrefs: 003D4E76, 003D4E79

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp$T=$T=
API String ID: 3884789274-1927087379
Opcode ID: 84c8f01001e5d70ae25c67c231cb9c97ac8b0d64244e165156c62482e5ec2ba0
Instruction ID: d8ed8c4ef8ffd05d4fa10f4bf1f9a786593a1ab8a4ef9ef8ede52f24e1d57832
Opcode Fuzzy Hash: 84c8f01001e5d70ae25c67c231cb9c97ac8b0d64244e165156c62482e5ec2ba0
Instruction Fuzzy Hash: 1671A033D01229BBCB229BA4DC41AEFBB7CAF04720F114227F910B6391D7749A518BE5

Function 003E741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to set original source variable., xrefs: 003E765D
WixBundleSourceProcessFolder, xrefs: 003E7627
WixBundleSourceProcessPath, xrefs: 003E75EB
WixBundleOriginalSource, xrefs: 003E764C
Failed to parse command line., xrefs: 003E755A
Failed to get manifest stream from container., xrefs: 003E74BF
Failed to open manifest stream., xrefs: 003E749E
Failed to initialize variables., xrefs: 003E7464
Failed to set source process folder variable., xrefs: 003E7638
Failed to get unique temporary folder for bootstrapper application., xrefs: 003E76C1
WixBundleUILevel, xrefs: 003E75C9, 003E75DA
Failed to load manifest., xrefs: 003E74DB
Failed to open attached UX container., xrefs: 003E7481
WixBundleElevated, xrefs: 003E7598, 003E75A9
Failed to load catalog files., xrefs: 003E7702
Failed to get source process folder from path., xrefs: 003E7618
Failed to initialize internal cache functionality., xrefs: 003E7692
Failed to overwrite the %ls built-in variable., xrefs: 003E75AE
Failed to extract bootstrapper application payloads., xrefs: 003E76E2
Failed to set source process path variable., xrefs: 003E75FC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 3ee242be8eda9bb3aadb15ba4f2eef577d1ec309ebce8c5b8dd00bd58f70df8c
Instruction ID: 7e237159f9bef5f638d73420dd751238db12f140af03c258467143261bf51d2c
Opcode Fuzzy Hash: 3ee242be8eda9bb3aadb15ba4f2eef577d1ec309ebce8c5b8dd00bd58f70df8c
Instruction Fuzzy Hash: 5BA17F72E44A7ABACB139AA5DC41FEAB76CBB14700F110326F505E6281D774EA448BD4

Function 003E85B1 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,003D4DFD,?,?,00000000,003D4DFD,00000000), ref: 003E85F4
GetLastError.KERNEL32 ref: 003E8601

Part of subcall function 00413709: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0041379F

SetFilePointerEx.KERNELBASE(00000000,0041A4B8,00000000,00000000,00000000,?,00000000,0041A500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E86AE
GetLastError.KERNEL32 ref: 003E86B8
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,0041A500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003E87E3

Strings

Failed to update signature offset., xrefs: 003E8702
Failed to seek to beginning of engine file: %ls, xrefs: 003E865A
Failed to seek to original data in exe burn section header., xrefs: 003E87BC
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E8625, 003E86DC, 003E8743, 003E87B2
Failed to seek to signature table in exe header., xrefs: 003E874D
msi.dll, xrefs: 003E86F5
Failed to create engine file at path: %ls, xrefs: 003E8632
Failed to seek to checksum in exe header., xrefs: 003E86E6
Failed to copy engine from: %ls to: %ls, xrefs: 003E8689
cabinet.dll, xrefs: 003E875C
Failed to zero out original data offset., xrefs: 003E87D5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: File$ErrorLast$ChangeCloseCreateFindNotificationPointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\66\s\src\burn\engine\cache.cpp$cabinet.dll$msi.dll
API String ID: 3608016165-3887126093
Opcode ID: 92c22e049d5e6d72a21eb0ba762dc18965347577ef89cd08317d4aa3409e7774
Instruction ID: 8e89a893f25f803ec5cd77444a7493be123f01d72a7f7a17e3ea0059a7303e47
Opcode Fuzzy Hash: 92c22e049d5e6d72a21eb0ba762dc18965347577ef89cd08317d4aa3409e7774
Instruction Fuzzy Hash: E351C973E41571BBE7135B659C46FBF7A68AB04710F224225FE04FB2C1EA29DC0056E9

Function 003D762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(003E745E,003D53FA,00000000,003D5482), ref: 003D764D

Strings

0, xrefs: 003D7664
LogonUser, xrefs: 003D7883
Failed to add built-in variable: %ls., xrefs: 003D7F1A
WixBundleExecutePackageCacheFolder, xrefs: 003D7D99
#, xrefs: 003D76CC
WixBundleSourceProcessFolder, xrefs: 003D7E9F
WixBundleForcedRestartPackage, xrefs: 003D7E15
', xrefs: 003D78EC
WixBundleInstalled, xrefs: 003D7E2B
WixBundleSourceProcessPath, xrefs: 003D7E8F
WixBundleAction, xrefs: 003D7D77
WixBundleTag, xrefs: 003D7EAF
WixBundleVersion, xrefs: 003D7ECF
$, xrefs: 003D7D4A
WixBundleProviderKey, xrefs: 003D7E7F
WixBundleUILevel, xrefs: 003D7EBF
InstallerVersion, xrefs: 003D7834
WixBundleExecutePackageAction, xrefs: 003D7DF9
Date, xrefs: 003D7771
WixBundleElevated, xrefs: 003D7E47
WixBundleActiveParent, xrefs: 003D7E63
InstallerName, xrefs: 003D7813

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: 8f30cd776c72443db2077e1e129d3cb4949ba26437761d0b0586a6f170ec3e5b
Instruction ID: f47538d9db71a6ba602a6dc68df8fa9eb3f240009c5069ced4de30a3848f0b5f
Opcode Fuzzy Hash: 8f30cd776c72443db2077e1e129d3cb4949ba26437761d0b0586a6f170ec3e5b
Instruction Fuzzy Hash: 183258B5D116299BDB61CF5AD9883CDFAB4FB48304F5085EED21CA6211C7B40BC98F89

Function 003E819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,003D54C6), ref: 003E81F5

Part of subcall function 00410141: OpenProcessToken.ADVAPI32(?,00000008,?,003D53FA,00000000,?,?,?,?,?,?,?,003E7590,00000000), ref: 0041015F
Part of subcall function 00410141: GetLastError.KERNEL32(?,?,?,?,?,?,?,003E7590,00000000), ref: 00410169
Part of subcall function 00410141: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,003E7590,00000000), ref: 004101F3

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 003E821B
GetLastError.KERNEL32 ref: 003E8225
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 003E82A2
GetLastError.KERNEL32 ref: 003E82AC
UuidCreate.RPCRT4(?), ref: 003E82EB

Strings

Failed to create working folder guid., xrefs: 003E82F8
Failed to convert working folder guid into string., xrefs: 003E832B
Failed to get windows path for working folder., xrefs: 003E8253
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E8249, 003E82D0, 003E8321
Failed to append bundle id on to temp path for working folder., xrefs: 003E8355
Failed to ensure windows path for working folder ended in backslash., xrefs: 003E8270
%ls%ls\, xrefs: 003E833D
Failed to concat Temp directory on windows path for working folder., xrefs: 003E8292
Failed to get temp path for working folder., xrefs: 003E82DA
Failed to copy working folder path., xrefs: 003E8370
Temp\, xrefs: 003E827A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2898636500-2821718772
Opcode ID: 393dcd1622867dd9c56c6b81dad4f4ced3562b7d4b3bf81f0fd343503e6d3c0f
Instruction ID: 17a16067606c4e0e2272305102f166f0bb049fec6b545fdeb987163198957cab
Opcode Fuzzy Hash: 393dcd1622867dd9c56c6b81dad4f4ced3562b7d4b3bf81f0fd343503e6d3c0f
Instruction Fuzzy Hash: 18412B77F41634B7D72297E19C09FAB736C6B00B10F114662BE09F71C0EA79DD448A99

Function 003F0EA0 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 003F0EC2
CoUninitialize.OLE32 ref: 003F113D

Strings

Failed to set operation complete event., xrefs: 003F1069
Invalid operation for this state., xrefs: 003F1121
<the>.cab, xrefs: 003F0F62
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F0F38, 003F105F, 003F10AC, 003F10EB, 003F1117
Failed to initialize COM., xrefs: 003F0ECE
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 003F101E
Failed to reset begin operation event., xrefs: 003F10F5
Failed to initialize cabinet.dll., xrefs: 003F0F44
Failed to wait for begin operation event., xrefs: 003F10B6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-964446333
Opcode ID: daec94914f9d926abef5adb270271f44fa9de0684fda0809f15ca4a235b616ad
Instruction ID: 6265e7ae109c372f5b1e15a123bfd0bc4a79783758a9f236b98b8fd4d6329bdc
Opcode Fuzzy Hash: daec94914f9d926abef5adb270271f44fa9de0684fda0809f15ca4a235b616ad
Instruction Fuzzy Hash: 72515B37E4127BE7D7235665BC01ABB76189B40B24F220236FF11BB681D92D8C50A6D9

Function 003D4326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,003D52A3,?,?,00000000,?,?), ref: 003D4352
InitializeCriticalSection.KERNEL32(000000D0,?,?,003D52A3,?,?,00000000,?,?), ref: 003D435B
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,003D52A3,?,?,00000000,?,?), ref: 003D43A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,003D52A3,?,?,00000000,?,?), ref: 003D43AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,003D52A3,?,?,00000000,?,?), ref: 003D43BF
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,003D52A3,?,?,00000000,?,?), ref: 003D43CF
lstrlenW.KERNEL32(burn.filehandle.self,?,?,003D52A3,?,?,00000000,?,?), ref: 003D441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,003D52A3,?,?,00000000,?,?), ref: 003D4429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,003D52A3,?,?,00000000,?,?), ref: 003D443D
lstrlenW.KERNEL32(burn.filehandle.self,?,?,003D52A3,?,?,00000000,?,?), ref: 003D444D

Strings

burn.filehandle.self, xrefs: 003D441A, 003D4422, 003D4427, 003D4428, 003D4448, 003D4518
Failed to parse file handle: '%ls', xrefs: 003D44CF
Failed to initialize engine section., xrefs: 003D44B6
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 003D44E2, 003D450E
burn.filehandle.attached, xrefs: 003D439C, 003D43A4, 003D43A9, 003D43AA, 003D43CA, 003D44EC
Missing required parameter for switch: %ls, xrefs: 003D44F1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3039292287-2540856168
Opcode ID: 149636e55a6204e2c776fd8b165c1531a93654348ff35765a724f50f3addf3e9
Instruction ID: 07f3843fc3796285596d7199e441942d6ebd9b24d419cdcd8571e99f4bb92c4c
Opcode Fuzzy Hash: 149636e55a6204e2c776fd8b165c1531a93654348ff35765a724f50f3addf3e9
Instruction Fuzzy Hash: 30512972A41211BFC7229F69EC46F9A7768FF00720F114127F608DB391D774A9A0CBA5

Function 003DC252 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,BT=,003DC442,BT=,?,?,003D5482), ref: 003DC299
GetLastError.KERNEL32 ref: 003DC2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,BT=,003DC442,BT=,?,?,003D5482,003D5482,00000000,?), ref: 003DC2F9
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 003DC2FF
DuplicateHandle.KERNELBASE(00000000), ref: 003DC302
GetLastError.KERNEL32 ref: 003DC30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000), ref: 003DC35E
GetLastError.KERNEL32 ref: 003DC368

Strings

c:\agent\_work\66\s\src\burn\engine\container.cpp, xrefs: 003DC2CE, 003DC330, 003DC38C
BT=, xrefs: 003DC252
crypt32.dll, xrefs: 003DC35A
Failed to open file: %ls, xrefs: 003DC2DB
Failed to open container., xrefs: 003DC3B4
Failed to move file pointer to container offset., xrefs: 003DC396
Failed to duplicate handle to container: %ls, xrefs: 003DC33D
feclient.dll, xrefs: 003DC35B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: BT=$Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\66\s\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-3422126002
Opcode ID: fc297ecb068cbf707c039c0d50e0aaed07389c4852f1f9435134040829c7a245
Instruction ID: cd8dc109a13d86e0bfb53c84a5e7a7e3eeb220e6d6cc7b81c43df833f91b9d71
Opcode Fuzzy Hash: fc297ecb068cbf707c039c0d50e0aaed07389c4852f1f9435134040829c7a245
Instruction Fuzzy Hash: E241EC3B160202A7D7228F55AD45F5B7BB9AFC4720B228026FD14AB341D639DC11DB65

Function 00412368 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003D38D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 003D3910
Part of subcall function 003D38D1: GetLastError.KERNEL32 ref: 003D391A

Part of subcall function 00414289: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 004142BA

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 004123B2
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 004123D2
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 004123F2
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00412412
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00412432
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00412452
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00412472

Strings

MsiDeterminePatchSequenceW, xrefs: 004123A7
MsiGetPatchInfoExW, xrefs: 00412407
Msi.dll, xrefs: 0041237A
MsiSetExternalUIRecord, xrefs: 00412447
MsiEnumProductsExW, xrefs: 004123E7
MsiSourceListAddSourceExW, xrefs: 00412467
MsiGetProductInfoExW, xrefs: 00412427
MsiDetermineApplicablePatchesW, xrefs: 004123C7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: ece022abe7d035c6cd843031d64814c2a7c505f431685488e98c44d6a87ba565
Instruction ID: eed0b6cb8be1306c9db807fb9d8c4ec723f91974bf9fed71844828988d9818cd
Opcode Fuzzy Hash: ece022abe7d035c6cd843031d64814c2a7c505f431685488e98c44d6a87ba565
Instruction Fuzzy Hash: 37312BB0501A48EBD7119F60FD07B9A3BA0E764708F20B13BE60095672D7B909A4DFCE

Function 003F14E3 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,003DC3AE,?,?), ref: 003F151A
GetLastError.KERNEL32(?,003DC3AE,?,?), ref: 003F1523

Strings

wininet.dll, xrefs: 003F14F9
Failed to create operation complete event., xrefs: 003F1597
Failed to wait for operation complete., xrefs: 003F15F6
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F1547, 003F158D, 003F15D9
Failed to create extraction thread., xrefs: 003F15E3
Failed to copy file name., xrefs: 003F1505
Failed to create begin operation event., xrefs: 003F1551

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-1014644744
Opcode ID: 95e2b792147c2ec04d4202a5eaf90c5fd19339148b15fca5da42a5a773d6074a
Instruction ID: f7f86077a531fac0b0fd79c9472423e11eb8659972a0235c2755f2eeae5aa9be
Opcode Fuzzy Hash: 95e2b792147c2ec04d4202a5eaf90c5fd19339148b15fca5da42a5a773d6074a
Instruction Fuzzy Hash: 8B213B73E8163FB7E22316A57C45F77695CAF417A0F124122FE05BB281EA68DC0056E9

Function 0040F58A Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 0040F5B2
GetProcAddress.KERNEL32(SystemFunction041), ref: 0040F5C4
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0040F607
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0040F61B
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0040F653
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 0040F667

Strings

Crypt32.dll, xrefs: 0040F5E8
SystemFunction040, xrefs: 0040F5A7
AdvApi32.dll, xrefs: 0040F591
c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 0040F63C
CryptUnprotectMemory, xrefs: 0040F648
CryptProtectMemory, xrefs: 0040F5FC
SystemFunction041, xrefs: 0040F5B4

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-686287438
Opcode ID: 0a3e9b29777fd7d937e3b78a60a094879888bd33d2c96fefda510fd1a3d87846
Instruction ID: c7d70786833b8483f77f1be8badc1814c1eaba4650770a66b0618d5c8aeb758a
Opcode Fuzzy Hash: 0a3e9b29777fd7d937e3b78a60a094879888bd33d2c96fefda510fd1a3d87846
Instruction Fuzzy Hash: 91217732942621B7D332AB556C057063950E704768F125537EE01BA7F0E77D8C4AAEDD

Function 003F0671 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 003F06A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 003F06B9
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 003F06BE
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 003F06C1
GetLastError.KERNEL32(?,?), ref: 003F06CB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 003F073A
GetLastError.KERNEL32(?,?), ref: 003F0747

Strings

Failed to add virtual file pointer for cab container., xrefs: 003F0720
<the>.cab, xrefs: 003F069A
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F06EF, 003F076B
Failed to open cabinet file: %hs, xrefs: 003F0778
Failed to duplicate handle to cab container., xrefs: 003F06F9

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-886985619
Opcode ID: db17635e7a706bf716a9d6a9fdb526aadecdfe5e360cc97a1bf5d0a5a5f8e215
Instruction ID: 306a2978df3c879dd0b6aa873e698cf58bd3c3240626f2fb586f639dcfc77ffe
Opcode Fuzzy Hash: db17635e7a706bf716a9d6a9fdb526aadecdfe5e360cc97a1bf5d0a5a5f8e215
Instruction Fuzzy Hash: 63313932D4113ABBD7225B589D45EAF7E6CEF04760F114161FE04B7241D738AC10DAE5

Function 003E6955 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,003D4E52,?,?), ref: 003E6975
GetCurrentProcess.KERNEL32(?,00000000,?,?,003D4E52,?,?), ref: 003E697B
DuplicateHandle.KERNELBASE(00000000,?,?,003D4E52,?,?), ref: 003E697E
GetLastError.KERNEL32(?,?,003D4E52,?,?), ref: 003E6988
CloseHandle.KERNEL32(000000FF,?,003D4E52,?,?), ref: 003E6A01

Strings

Failed to duplicate file handle for attached container., xrefs: 003E69B6
burn.filehandle.attached, xrefs: 003E69CE
%ls -%ls=%u, xrefs: 003E69D5
Failed to append the file handle to the command line., xrefs: 003E69E9
RN=, xrefs: 003E69CB, 003E69D3, 003E69DA
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 003E69AC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$RN=$burn.filehandle.attached$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 4224961946-3653527318
Opcode ID: 4aca7e3758aaad768acb1d66acd8612f3f355cd253b6c06c1c0fe06cbc60eb92
Instruction ID: 70f128d584d202b0c8983b33eeb8b20f04cd01e3d900ad643ed1a98ff3917aa7
Opcode Fuzzy Hash: 4aca7e3758aaad768acb1d66acd8612f3f355cd253b6c06c1c0fe06cbc60eb92
Instruction Fuzzy Hash: 64110672A41231B7CB119BAA9D06F9E7BAC9F11770F224322F910F72D1D7789E108694

Function 00410141 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,003D53FA,00000000,?,?,?,?,?,?,?,003E7590,00000000), ref: 0041015F
GetLastError.KERNEL32(?,?,?,?,?,?,?,003E7590,00000000), ref: 00410169
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,003E7590,00000000), ref: 0041019B
GetLastError.KERNEL32(?,?,?,?,?,?,?,003E7590,00000000), ref: 004101B4
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,003E7590,00000000), ref: 004101F3

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 004101E1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-2457365779
Opcode ID: 498b8359c5c88151b007b5701be1966200491f631d72cb572ba4c34cc5b5c820
Instruction ID: 4c9f2f47880c7e7ec0807d899c2b395b4faadbedaca3bf44d3c878422469e20d
Opcode Fuzzy Hash: 498b8359c5c88151b007b5701be1966200491f631d72cb572ba4c34cc5b5c820
Instruction Fuzzy Hash: 3A21A476E41125FBCB229F958C04ADEBEB8AF04750F118067ED05BB250D6BD8E80DAD9

Function 003E6A0F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 003E6A43
CloseHandle.KERNEL32(00000000), ref: 003E6AB3

Strings

burn.filehandle.self, xrefs: 003E6A54, 003E6A86
%ls -%ls=%u, xrefs: 003E6A5B, 003E6A8D
Failed to append the file handle to the command line., xrefs: 003E6A6F
Failed to append the file handle to the obfuscated command line., xrefs: 003E6AA1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: 61d4c1c6d1e07fd7f68be00c73f8e18844898c6ea2bb86ea34b02cb2ea6791a1
Instruction ID: f9beb17d9b9d630a4de5984d0538d16a3b10228c8f9b3cf7687234d02ad57bdb
Opcode Fuzzy Hash: 61d4c1c6d1e07fd7f68be00c73f8e18844898c6ea2bb86ea34b02cb2ea6791a1
Instruction Fuzzy Hash: 4011E671B41270BBCB229BAADC06F9B3BA8AB51B70F128326F920B72D1D27445118695

Function 00412DC7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00412DD6
InterlockedIncrement.KERNEL32(0043B69C), ref: 00412DF3
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,0043B688,?,?,?,?,?,?), ref: 00412E0E
CLSIDFromProgID.OLE32(MSXML.DOMDocument,0043B688,?,?,?,?,?,?), ref: 00412E1A

Strings

Msxml2.DOMDocument, xrefs: 00412E09
MSXML.DOMDocument, xrefs: 00412E15

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: 552eaf02ebfc14bac7a8385e0865a7a157bfa9531dcb7e1d68ca2a8b9235b237
Instruction ID: 6b4049797151d3e863cc7f68ca479cf7776bd9b45352d3c319ea9ff8dfbef288
Opcode Fuzzy Hash: 552eaf02ebfc14bac7a8385e0865a7a157bfa9531dcb7e1d68ca2a8b9235b237
Instruction Fuzzy Hash: 07F0A03074523597D7210761AE0AFCB2F6AD794B61F502027E901C1151C3EC88A18AEE

Function 00414289 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 004142BA
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 004142E7
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00414313
GetLastError.KERNEL32(00000000,0041A800,?,00000000,?,00000000,?,00000000), ref: 00414351
GlobalFree.KERNEL32(00000000), ref: 00414382

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 004142D5, 0041432E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1688708105
Opcode ID: 37c65ce3d0a9f0f4d0911b523f3e4c451041c874cec98b1e0dea8aae92db1cef
Instruction ID: ff056891743c18ca16faf3b1744c462e42e5f2f98ac1a0dd8baa236eefccafb3
Opcode Fuzzy Hash: 37c65ce3d0a9f0f4d0911b523f3e4c451041c874cec98b1e0dea8aae92db1cef
Instruction Fuzzy Hash: 1231F637E4023AABC7129B958C01EEFBAA4AF84760F114267FC14E7340D638CD8196E9

Function 003F082C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 003F08D2
GetLastError.KERNEL32(?,?,?), ref: 003F08DC

Strings

Invalid seek type., xrefs: 003F0868
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F0900
Failed to move file pointer 0x%x bytes., xrefs: 003F090D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-424406494
Opcode ID: d746b547361e57450790830db074c5f5a6e0ed3d69fc4cd9566f41d5eafeae82
Instruction ID: 03da6f92c2dd543b5013d21e9367bf58d8c86b92abd011d2a4e321d7f6a3fe16
Opcode Fuzzy Hash: d746b547361e57450790830db074c5f5a6e0ed3d69fc4cd9566f41d5eafeae82
Instruction Fuzzy Hash: D3319E72A0011AEFDB0ACFACD945EA9B7A8FB04764B158125FA14A7652E374ED10CBD0

Function 003D415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,003E9FBC,00000000,00000000,?,00000000,003D53FA,00000000,?,?,003DD567,?), ref: 003D416D
GetLastError.KERNEL32(?,003E9FBC,00000000,00000000,?,00000000,003D53FA,00000000,?,?,003DD567,?,00000000,00000000), ref: 003D417B
CreateDirectoryW.KERNEL32(?,840F01E8,003D54C6,?,003E9FBC,00000000,00000000,?,00000000,003D53FA,00000000,?,?,003DD567,?,00000000), ref: 003D41EB
GetLastError.KERNEL32(?,003E9FBC,00000000,00000000,?,00000000,003D53FA,00000000,?,?,003DD567,?,00000000,00000000), ref: 003D41F5

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 003D4225

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-2061300336
Opcode ID: e723bc68e684f73c9bed7f30b26dcc231bf7cce99d3e39e0effd9f56d615d951
Instruction ID: 0ba1195a2fc08eafa5f1b88f76a448eb84d92f0701405264af554a805fdc17a8
Opcode Fuzzy Hash: e723bc68e684f73c9bed7f30b26dcc231bf7cce99d3e39e0effd9f56d615d951
Instruction Fuzzy Hash: 83210137A40231E7DB231AA1BC84B7BA6A9AB65B60F138427FD44EA340D234CC4192D5

Function 003D56E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,003D65B1,003D65B1,?,003D5678,?,?,00000000), ref: 003D571E
GetLastError.KERNEL32(?,003D5678,?,?,00000000,?,?,003D65B1,?,003D7F03,?,?,?,?,?), ref: 003D574D

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D5771
Failed to compare strings., xrefs: 003D577B
version.dll, xrefs: 003D5710

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$version.dll
API String ID: 1733990998-1548471634
Opcode ID: 0a90a84057e3e8c510cc5dfb90a70f88d7b7a26be6a26f9b04c1d75bd3558dc7
Instruction ID: 50e3400f22b4aabe6ac54e6fa5d5fd3bae2a6af7e529376e0c6e928bcc60a2e3
Opcode Fuzzy Hash: 0a90a84057e3e8c510cc5dfb90a70f88d7b7a26be6a26f9b04c1d75bd3558dc7
Instruction Fuzzy Hash: A921F977641525EBC7168FA8DD45A99BBA4AF05770B35031AE911EB3C0E634ED018AA0

Function 004059AD Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000100,00000000,0040372D,003D3CE2,80004005,00000000,?,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7), ref: 004059B2
_free.LIBCMT ref: 004059E7
_free.LIBCMT ref: 00405A0E
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00405A1B
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00405A24

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: f08b7ce92cb067425d2728109a7f216414240c3444c107d3fca0d08635d4b0d2
Instruction ID: ff85bea4362154e356bcfd06bbdde8da98c8b2263b2344ef8fa11cdd5401890f
Opcode Fuzzy Hash: f08b7ce92cb067425d2728109a7f216414240c3444c107d3fca0d08635d4b0d2
Instruction Fuzzy Hash: 48012132346E00ABD6126B3A6C86A6B2529EBC5334721423FF415B23D2EF3C8C114D6E

Function 003F0797 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003F11B1: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,003F07C6,?,?,?), ref: 003F11D9
Part of subcall function 003F11B1: GetLastError.KERNEL32(?,003F07C6,?,?,?), ref: 003F11E3

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 003F07D4
GetLastError.KERNEL32 ref: 003F07DE

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F0802
Failed to read during cabinet extraction., xrefs: 003F080C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-3499834177
Opcode ID: 2042dc3462bc20c0a11eb9df40158435c8b4da6879e3e6285dddb049d400cae9
Instruction ID: ad001f690b6f152819cc11ecbbf0a4d37c7c27b87456ed55a3d710c78740632e
Opcode Fuzzy Hash: 2042dc3462bc20c0a11eb9df40158435c8b4da6879e3e6285dddb049d400cae9
Instruction Fuzzy Hash: 7901E532A40269BBCB12DF98ED04D9A7BA8FF04764F014125FE04A7251D734E910DAD4

Function 003F11B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,003F07C6,?,?,?), ref: 003F11D9
GetLastError.KERNEL32(?,003F07C6,?,?,?), ref: 003F11E3

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F1207
Failed to move to virtual file pointer., xrefs: 003F1211

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1387633737
Opcode ID: e052727fe51eb231a9de300370b002fd59865bf09e4a95673134dc83ab7f6793
Instruction ID: 918dea1be786603d1a26b6c553f5c694654d5ca8c591902dac8d25b9c55a1472
Opcode Fuzzy Hash: e052727fe51eb231a9de300370b002fd59865bf09e4a95673134dc83ab7f6793
Instruction Fuzzy Hash: 4D01D43390113AB7D7221A96BC0499BFF28EF007B0711C126FE18AA211D63A9C2086D4

Function 00413709 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 0041379F
GetLastError.KERNEL32 ref: 00413802

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00413826

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-1688708105
Opcode ID: 1300e8903197d75d131819ca6e7675012225a678466c89378cc56523830e694e
Instruction ID: 5016ece85f11743d00e17bc2f23d7f73315a6b5425d76f62a4abcbf74a55e12d
Opcode Fuzzy Hash: 1300e8903197d75d131819ca6e7675012225a678466c89378cc56523830e694e
Instruction Fuzzy Hash: 193183B1E002699BDB21DF14CD407DAB7A4BB08752F0080ABF959E7380D778DEC48A99

Function 00414650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,004137C6,?,?,?), ref: 00414674
GetLastError.KERNEL32(?,?,004137C6,?,?,?), ref: 0041467E

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 004146A7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-1688708105
Opcode ID: 372e2ee91fc4e351085cbfd0885b78d3ee1729f33a27130118a9455ea882b758
Instruction ID: 6e501f761d7871dfd3354ba9eb83f38079cbc530f6ab74dd101910f346fcf07d
Opcode Fuzzy Hash: 372e2ee91fc4e351085cbfd0885b78d3ee1729f33a27130118a9455ea882b758
Instruction Fuzzy Hash: A1F0D133A00129FBC7118E9ACD44EDFBBADBB85761F014122FD04EB240D678ED1086E5

Function 0041412E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,003E8651,00000000,00000000,00000000,00000000,00000000), ref: 00414146
GetLastError.KERNEL32(?,?,?,003E8651,00000000,00000000,00000000,00000000,00000000), ref: 00414150

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00414174

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-1688708105
Opcode ID: a70acff21c718e6b19a3a393f77bd5f7c216c143dedc024ac213bbf963bcd7fa
Instruction ID: 705d786b8f6b2050e2eeb10bbd4c216343cbc66d3bbc031fdec46b3ac0319fb7
Opcode Fuzzy Hash: a70acff21c718e6b19a3a393f77bd5f7c216c143dedc024ac213bbf963bcd7fa
Instruction Fuzzy Hash: DFF0A472A0012ABB9B218F84DD09EDB7FA9EF54760F028055FD04AB351E274DD90D6E9

Function 003D38D1 Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 003D3910
GetLastError.KERNEL32 ref: 003D391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 003D3983

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: ddfd0d195f1b95370f09d6c37ff5e39178e2482b31ebfc4365c4aa16c53e5ed1
Instruction ID: bb343c8deb6e14523f7235b955719cddba1151c910932fe983411d936679dced
Opcode Fuzzy Hash: ddfd0d195f1b95370f09d6c37ff5e39178e2482b31ebfc4365c4aa16c53e5ed1
Instruction Fuzzy Hash: 0721C8B7D0133967DB229BA4AC59F9A77A8AF04724F110262BE04FB341D774DE448692

Function 003D3AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,0040FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0040FB1B,000001C7), ref: 003D3AAE
RtlFreeHeap.NTDLL(00000000,?,0040FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0040FB1B,000001C7,?,?), ref: 003D3AB5
GetLastError.KERNEL32(?,0040FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,0040FB1B,000001C7,?,?), ref: 003D3ABF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: 0afd826b2d44a50f3203b4944d2bcada299cd48c674b898328d959c7093c55f9
Instruction ID: a1e2ecd707a86b81ef2358b53077fb4de89488d665c0babcaba957e166ed79b2
Opcode Fuzzy Hash: 0afd826b2d44a50f3203b4944d2bcada299cd48c674b898328d959c7093c55f9
Instruction Fuzzy Hash: 6AD01273B0113A6787221BE57C0C9A7BE58EF056A1B068131FD44E6210EA25CD1097EA

Function 00412E25 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00412E5A

Part of subcall function 004128BD: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00412E6B,00000000,?,00000000), ref: 004128D7
Part of subcall function 004128BD: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,BT=,003FBD14,0041A518,BT=,?,00000000,?), ref: 004128E3

Strings

BT=, xrefs: 00412E25

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID: BT=
API String ID: 52713655-182473981
Opcode ID: ed1f73f23039a5bb6e40471cd51b50335680417ccf5b2077242d187b565d4b2b
Instruction ID: fd507608582691bea57416ecda64d2d68bdf66caf57172672027742d14bbc1cc
Opcode Fuzzy Hash: ed1f73f23039a5bb6e40471cd51b50335680417ccf5b2077242d187b565d4b2b
Instruction Fuzzy Hash: 25314B72E006299BCB11DFA8C984ADEB7B8FF08710F01456AE915FB311E6749D508BA4

Function 00410823 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00410874

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3237223240
Opcode ID: 42b0730ddc98ffcfb5a4e6b1070605cd483fa242f22fa409ee5975a0f54fff04
Instruction ID: d43c702052829ac50e82ce3d9189baab7066d5f449f74732a83ad5f8e3072ba7
Opcode Fuzzy Hash: 42b0730ddc98ffcfb5a4e6b1070605cd483fa242f22fa409ee5975a0f54fff04
Instruction Fuzzy Hash: FBF0B432A48125A3873129969C05BEB7E459B447B0F154027BD49EB364D6A9CCD093E9

Function 003D3B7C Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,?,003D2375,000001C7,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000), ref: 003D3B90
RtlReAllocateHeap.NTDLL(00000000,?,003D2375,000001C7,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3B97

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 14cdaef63d71dec8a120ae510be858bed9b337628a0ff683601fcea1c98519fb
Instruction ID: 7aaf01418927f8e099526fb83e83afc810d60a818a2933ae7ea8829fe28afa45
Opcode Fuzzy Hash: 14cdaef63d71dec8a120ae510be858bed9b337628a0ff683601fcea1c98519fb
Instruction Fuzzy Hash: F4D0C93219420DBB8F005FE8DC09DAA3BADEB58612B04C415B915C2110C63DE4209A65

Function 003D39DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: f5661eb3a1ca96777d4c66d2fd8cb15061d89afc579a7acb7299d204474b9286
Instruction ID: 333b257bbc0558aea3cce87baf9457798f0d6b7795814f4157bf5a2d0ac81604
Opcode Fuzzy Hash: f5661eb3a1ca96777d4c66d2fd8cb15061d89afc579a7acb7299d204474b9286
Instruction Fuzzy Hash: A2C0123219420CBB8B005FF4DC0DC9637ACB714612B04C410B505C2110C638E4208765

Function 0041506B Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,0043AA7C,00000000,80070490,?,?,003E89F4,WiX\Burn,PackageCache,00000000,0043AA7C,00000000,00000000,80070490), ref: 004150C5

Part of subcall function 0041095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004109D4
Part of subcall function 0041095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00410A0C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: e27fef77ba4f244891f787e44753280fb8f4be1e7df097bf0fa34c2824f57714
Instruction ID: f4ce24a051c37aef000b0b88f7433dcd3445a90cc8ba04388e118f44a430339c
Opcode Fuzzy Hash: e27fef77ba4f244891f787e44753280fb8f4be1e7df097bf0fa34c2824f57714
Instruction Fuzzy Hash: BB11C63680152AEBCB326FD489855EFBE65DB88360B11413BFD4167310C7794DD0D6DA

Function 004071F5 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004059DE,00000001,00000364), ref: 00407236

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6b275ccdeb29da6211cda5e7d62c14a28188796ccac2d13ea3b05cc73c49c2a7
Instruction ID: 90acedd11ff295d6c75da9137a9fdb068db815791c88fc30c42d97da7fda77d6
Opcode Fuzzy Hash: 6b275ccdeb29da6211cda5e7d62c14a28188796ccac2d13ea3b05cc73c49c2a7
Instruction Fuzzy Hash: CDF0BB31F48125B6DB215A639C05A5B3788AB817B0B15A57BBD04B62D0CA38FC0142EF

Function 003D35A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,003E8AAE,0000001C,80070490,00000000,00000000,80070490), ref: 003D35C8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: d7c4bc19c24d63b24c9eae6b0e5658e7b45868d25d1ad6e2202e27454e07eb04
Instruction ID: 523c2324ab2704e7e7e73210b9816e575a39a22d77ac096e986b4c63a1154d30
Opcode Fuzzy Hash: d7c4bc19c24d63b24c9eae6b0e5658e7b45868d25d1ad6e2202e27454e07eb04
Instruction Fuzzy Hash: 75E012733411247BE6022AA57C01DFB7B5DDF163A17044052FE40D6100DA61DA1057B5

Function 0040ED5A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0040ED51

Part of subcall function 004190AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00419121
Part of subcall function 004190AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00419132

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 339fe1caf01f03f3bbed1f9a766828a9e1b3bc898f1679cdca42475ecf13d7ce
Instruction ID: 85e4eafa9bef4d8e49f1d71189d5a9977f448eeeb6bd09333f9ede8f50f07a2b
Opcode Fuzzy Hash: 339fe1caf01f03f3bbed1f9a766828a9e1b3bc898f1679cdca42475ecf13d7ce
Instruction Fuzzy Hash: 31B012E529D003AE312491071E13E7B014CCAEDB20731A86FF084D5080D48D5D52007F

Function 0040ED6A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0040ED51

Part of subcall function 004190AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00419121
Part of subcall function 004190AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00419132

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fb747f4b888beecb60931aa5540827a0fc80457fbae07b3807396af3024b318f
Instruction ID: 84f2c93e00acc4a4d49684f9d1447a54100e180d05ce4374040d1f0d29574ae9
Opcode Fuzzy Hash: fb747f4b888beecb60931aa5540827a0fc80457fbae07b3807396af3024b318f
Instruction Fuzzy Hash: DCB012E529D1036D312491071D12E7B014CCADDB20731E9AFF084D5080D49C5D91007F

Function 0040ED39 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0040ED51

Part of subcall function 004190AE: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00419121
Part of subcall function 004190AE: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00419132

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e6ec69162f83d4cc896fbfdcfd9d326fef3b072bb126ce67f5767475df56f9df
Instruction ID: 44c28f15a3488900a7e11d2d212e26781a00d043cc30dc29aa699254acd1755a
Opcode Fuzzy Hash: e6ec69162f83d4cc896fbfdcfd9d326fef3b072bb126ce67f5767475df56f9df
Instruction Fuzzy Hash: 13B012E929D0037D312451031D16D7B010CCAD9B20731E86FF480E4080948C5D5100BF

Non-executed Functions

Function 003D3D4E Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 309fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 003D3DAD
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D3DC0
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 003D3E0C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D3E16
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 003D3E5D
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D3E67
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 003D3EB5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D3EC6
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 003D3F98
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,?), ref: 003D3FAC
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 003D3FD5
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 003D3FF8
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 003D4011
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 003D4021
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D4036
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D4065
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D4087
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D40A9
RemoveDirectoryW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 003D40B3
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D40BD
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 003D40E1
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D40FC
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 003D4132

Strings

DEL, xrefs: 003D3FC9
c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 003D3DE3, 003D4056
*.*, xrefs: 003D3E93

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1544372074-2145791747
Opcode ID: 947249446ebd1da747a2fb1de924fb5b05357061f0e4257888c5a10ff5403b8d
Instruction ID: 12de13c799b89b0a862696285b9572852740aa33a4a9b094f6f2b14e4745e7a3
Opcode Fuzzy Hash: 947249446ebd1da747a2fb1de924fb5b05357061f0e4257888c5a10ff5403b8d
Instruction Fuzzy Hash: 3CA11973D41239A7D7339664AC05BEABA699F10760F0642A3EE44FB390D775CE80CAD1

Function 00410FA6 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 0041103E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411048
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00411095
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041109B
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 004110D5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004110DB
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 0041111B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411121
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00411161
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411167
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 004111A7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004111AD
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 0041129E
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 004112D8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004112E2
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 0041131A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411324
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0041135D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411367
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 004113A5
LocalFree.KERNEL32(?), ref: 004113BB

Strings

c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 00411069

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: c:\agent\_work\66\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-212431265
Opcode ID: b610bfda7d501c9c02ddc90219a3e72f11d67576729a8563c138343d1fba6f0f
Instruction ID: 99ca7e3ceae6defc05474dbd55f7e21eb0cbe4482835cdb1383ae6d0c3365220
Opcode Fuzzy Hash: b610bfda7d501c9c02ddc90219a3e72f11d67576729a8563c138343d1fba6f0f
Instruction Fuzzy Hash: F7C15476C4123DABD7218F958C48BDFFAB8AF44750F0141ABAE05F7250E6749D808EA5

Function 003FC01F Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to allocate space for burn payload inside of related bundle struct, xrefs: 003FC0AA
Failed to copy display name for pseudo bundle., xrefs: 003FC43B
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 003FC065, 003FC09E, 003FC18D, 003FC3BE
Failed to copy repair arguments for related bundle package, xrefs: 003FC2BC
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 003FC071
Failed to allocate memory for pseudo bundle payload hash., xrefs: 003FC199
Failed to copy cache id for pseudo bundle., xrefs: 003FC24B
Failed to append relation type to install arguments for related bundle package, xrefs: 003FC294
Failed to copy filename for pseudo bundle., xrefs: 003FC103
Failed to copy download source for pseudo bundle., xrefs: 003FC155
-%ls, xrefs: 003FC03C
Failed to copy local source path for pseudo bundle., xrefs: 003FC127
Failed to allocate memory for dependency providers., xrefs: 003FC3CA
Failed to append relation type to repair arguments for related bundle package, xrefs: 003FC2DD
Failed to copy key for pseudo bundle., xrefs: 003FC22C
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 003FC330
Failed to copy version for pseudo bundle., xrefs: 003FC419
Failed to copy key for pseudo bundle payload., xrefs: 003FC0DF
Failed to copy install arguments for related bundle package, xrefs: 003FC273
Failed to copy uninstall arguments for related bundle package, xrefs: 003FC30F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-3959581252
Opcode ID: 200ed24f9e7d196eeed2a41a166455096e962329adcdf282311ce4f6ad0e2786
Instruction ID: 1108c7094140165ed6b678abb6e79e5d21ebc33ed2c04a62601d8fa6d469a0c9
Opcode Fuzzy Hash: 200ed24f9e7d196eeed2a41a166455096e962329adcdf282311ce4f6ad0e2786
Instruction Fuzzy Hash: 0CC1F1727A062EABDB278E29CA41F7A77A8BF04710B515527FE11EB341D774EC108B90

Function 003D4639 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 003D4662
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 003D4669
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 003D4673
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 003D46C3
GetLastError.KERNEL32 ref: 003D46CD
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 003D4711
GetLastError.KERNEL32 ref: 003D471B
Sleep.KERNEL32(000003E8), ref: 003D4757
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 003D4768
GetLastError.KERNEL32 ref: 003D4772
CloseHandle.KERNEL32(?), ref: 003D47C8

Strings

Failed to get shutdown privilege LUID., xrefs: 003D46FB
Failed to schedule restart., xrefs: 003D47B3
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 003D4697, 003D46F1, 003D473F, 003D47A9
SeShutdownPrivilege, xrefs: 003D46B6
Failed to adjust token to add shutdown privileges., xrefs: 003D4749
Failed to get process token., xrefs: 003D46A1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 2241679041-3136258258
Opcode ID: c1f6bde8a644eabfdfdad85365045ec402c6ad2cdf43400d93073a943bb16e9a
Instruction ID: e454df2aefc0a74f5205d96449cf868836670f72b90b55c5bf5fe186fa58c854
Opcode Fuzzy Hash: c1f6bde8a644eabfdfdad85365045ec402c6ad2cdf43400d93073a943bb16e9a
Instruction Fuzzy Hash: 3F411C7394122577E7225FA46D49BEF7A68AB05751F134136FE11BB380D7388C4085E6

Function 003E4E6A Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 164pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 003E4E98
GetLastError.KERNEL32(?,00000000,?,?,003D457C,?), ref: 003E4EA1
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,003D457C,?), ref: 003E4F43
GetLastError.KERNEL32(?,003D457C,?), ref: 003E4F50
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,003D457C), ref: 003E4FCB
GetLastError.KERNEL32(?,?,?,?,?,?,?,003D457C,?), ref: 003E4FD6
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\burn\engine\pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,003D457C,?), ref: 003E5016
LocalFree.KERNEL32(00000000,?,003D457C,?), ref: 003E5044

Strings

Failed to create the security descriptor for the connection event and pipe., xrefs: 003E4ECF
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E4EC5, 003E4F74, 003E4FFA
\\.\pipe\%ls.Cache, xrefs: 003E4F97
\\.\pipe\%ls, xrefs: 003E4EF9
Failed to create pipe: %ls, xrefs: 003E4F81, 003E5007
Failed to allocate full name of cache pipe: %ls, xrefs: 003E4FAD
Failed to allocate full name of pipe: %ls, xrefs: 003E4F0F
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 003E4E93

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1214480349-1710103387
Opcode ID: df35089ec40606702725e486429c41b2406810e4f8aaf51b0ab0e1a5675b65c4
Instruction ID: 27872b199a577ee53d4cca39a53f5f1021f16a3f7c27daee130a6157c8c9b7ad
Opcode Fuzzy Hash: df35089ec40606702725e486429c41b2406810e4f8aaf51b0ab0e1a5675b65c4
Instruction Fuzzy Hash: A6510972E41235BBDB229F95DC06B9EBB74AF08715F114221FD00BA2C1D3795E408AD5

Function 0040F340 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 172encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,003E9DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0), ref: 0040F3A5
GetLastError.KERNEL32 ref: 0040F3AF
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 0040F3EC
GetLastError.KERNEL32 ref: 0040F3F6
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 0040F43D
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 0040F461
GetLastError.KERNEL32 ref: 0040F46B
CryptDestroyHash.ADVAPI32(00000000), ref: 0040F4A8
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040F4BF
GetLastError.KERNEL32 ref: 0040F4D8
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 0040F510
GetLastError.KERNEL32 ref: 0040F51A
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 0040F553
GetLastError.KERNEL32 ref: 0040F561

Strings

c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 0040F48F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 3955742341-1443093764
Opcode ID: fc786792c383339671fbb826037ef3f4ed0e043e88fc776b25c2b495103719d3
Instruction ID: 72366c9da3bc6de9cc52a972d23853fd362313ba04d7401e7555c0488582d179
Opcode Fuzzy Hash: fc786792c383339671fbb826037ef3f4ed0e043e88fc776b25c2b495103719d3
Instruction Fuzzy Hash: 9951DA37D41235ABD7318F548D04BEB7A64BF08751F0140B6BE48FA6D0E3789D889AE9

Function 003E9D74 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

Failed to concat complete cached path., xrefs: 003E9DCA
copying, xrefs: 003E9F06, 003E9F0E
Failed to create unverified path., xrefs: 003E9E44
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 003E9EA1
Failed to get cached path for package with cache id: %ls, xrefs: 003E9D9E
Failed to reset permissions on unverified cached payload: %ls, xrefs: 003E9EC7
moving, xrefs: 003E9EFF
Failed to move verified file to complete payload path: %ls, xrefs: 003E9F42
Failed to transfer working path to unverified path for payload: %ls., xrefs: 003E9E7A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 157ffd289ccda314792d2cdd76aba9ec6486292d8203fa0adb2c5ffd7afcbb49
Instruction ID: 4d408662af1e859e632fd1dbd6067fefd4caafe29b15b9fd953997f8da6c5196
Opcode Fuzzy Hash: 157ffd289ccda314792d2cdd76aba9ec6486292d8203fa0adb2c5ffd7afcbb49
Instruction Fuzzy Hash: C3518332D40565BADF23AB91DC02F9D7B76AF14701F110262FA00B51A1E7755E61AB84

Function 003D62CC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 003D631A
GetLastError.KERNEL32 ref: 003D6324

Strings

Failed to get OS info., xrefs: 003D6352
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D6348
Failed to set variant value., xrefs: 003D6445

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 305913169-1157376746
Opcode ID: afc3e6b3ac02ecbb82dd2b0a97c2f37ed51b3b09f2989efa61327dc02ddadb2c
Instruction ID: 170a461d1a00e116a5b067c8376499d2455f1e2775171ce6ce38322f548b557b
Opcode Fuzzy Hash: afc3e6b3ac02ecbb82dd2b0a97c2f37ed51b3b09f2989efa61327dc02ddadb2c
Instruction Fuzzy Hash: 2F41E6B2A01228ABD721CB69EC46EEF7BBCEB85710F10405BF555E7250D634AE81CB54

Function 003D605F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 003D608A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 003D609E
GetLastError.KERNEL32 ref: 003D60B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 003D6104
GetLastError.KERNEL32 ref: 003D610E

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D60CB, 003D6129
Failed to allocate the buffer for the Date., xrefs: 003D60EC
Failed to get the Date., xrefs: 003D6133
Failed to set variant value., xrefs: 003D614C
Failed to get the required buffer length for the Date., xrefs: 003D60D5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2700948981-3414009094
Opcode ID: eb30476dfd5ab4b4c7d90012f14541714ba622a9f1a5cdf6707709479c506d32
Instruction ID: 2c33dd3be9ec7cc524d6f4917a8b3b9c209ff40df396301ef0d04e1af4e0d36f
Opcode Fuzzy Hash: eb30476dfd5ab4b4c7d90012f14541714ba622a9f1a5cdf6707709479c506d32
Instruction Fuzzy Hash: 20319533A402297BDB139AE4AC83FEFBA78AB04750F110127FB11F7381DA649D4486E5

Function 0040F79E Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043B5D4,00000000,?,?,?,?,003F1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0040F7CC
GetCurrentProcessId.KERNEL32(00000000,?,003F1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0040F7DC
GetCurrentThreadId.KERNEL32 ref: 0040F7E5
GetLocalTime.KERNEL32(8007139F,?,003F1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0040F7FB
LeaveCriticalSection.KERNEL32(0043B5D4,003F1074,?,00000000,0000FDE9,?,003F1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 0040F8F2

Strings

[C, xrefs: 0040F848
%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 0040F898
[C, xrefs: 0040F82B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$[C$[C
API String ID: 296830338-1452150563
Opcode ID: 8c8021a8bfec640ce2c6f530bc8cf57d0aa69fb075e41145f35318cbe9bd7c63
Instruction ID: 35ed048677e8b2854120412b77017fd68384ada1c7cde309e9b38fa00372b2d5
Opcode Fuzzy Hash: 8c8021a8bfec640ce2c6f530bc8cf57d0aa69fb075e41145f35318cbe9bd7c63
Instruction Fuzzy Hash: 2A419F72D01219ABDB219FA4D844BFFB7B9EB08715F108036F901B62A0D73C9D45CBA9

Function 003E9A1D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 003E9ACC
lstrlenW.KERNEL32(?), ref: 003E9AF3
FindNextFileW.KERNEL32(00000000,00000010), ref: 003E9B53
FindClose.KERNEL32(00000000), ref: 003E9B5E

Part of subcall function 003D3D4E: GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 003D3DAD
Part of subcall function 003D3D4E: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 003D3DC0

Strings

.unverified, xrefs: 003E9A60
*.*, xrefs: 003E9AA6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: 573c43aec78e87b785e5b4ac8ba3fded8f07585e45ee0c7f6858d3b54ae049bf
Instruction ID: 9f39580eafd1be9b946384b4781aa045924a401f7b39460d5ce2260d80d9c62c
Opcode Fuzzy Hash: 573c43aec78e87b785e5b4ac8ba3fded8f07585e45ee0c7f6858d3b54ae049bf
Instruction Fuzzy Hash: CD41713190067DAECB62AB61EC49BEEB7B8AF44301F1002E2E508E50A1E7749ED4DF44

Function 00418039 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 0041808E
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 004180A0

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00418077
crypt32.dll, xrefs: 0041805E
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 004180EB
feclient.dll, xrefs: 00418068

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: d40ac860c02699f9b0377ab9c27025db7255c9c7f12a7b01216bddb0eacef046
Instruction ID: 8a61357cd1f1e74a9ceaa2ac6a90f3693e1808464004b6ed86ff651201768e73
Opcode Fuzzy Hash: d40ac860c02699f9b0377ab9c27025db7255c9c7f12a7b01216bddb0eacef046
Instruction Fuzzy Hash: 6E213CA6900128BAD720DF999C05FBFB3FCAB4C711F108456B945D2180E63CAA84D775

Function 003D6203 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 003D6233
GetLastError.KERNEL32 ref: 003D623D

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D625C
Failed to get the user name., xrefs: 003D6266
Failed to set variant value., xrefs: 003D6282

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2054405381-2744047247
Opcode ID: a59b2b98dbac645fc56bd89aebb90720ad1dc0e1c856259b08edd69856fbee35
Instruction ID: e06551a58b07939f66aaa5327713efcdaf2862f082d45c857dc61e25ffa087a5
Opcode Fuzzy Hash: a59b2b98dbac645fc56bd89aebb90720ad1dc0e1c856259b08edd69856fbee35
Instruction Fuzzy Hash: C201D633A0123867D722DB65AC46AEF77A8AB00710F110267F854E7381DA389D488AD9

Function 003D2078 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(003D42CC,003D54CB,?,00000000,00000000,00000000,?,80070656,?,?,?,003EE5B6,00000000,003D54CB,00000000,80070656), ref: 003D20A9
GetLastError.KERNEL32(?,?,?,003EE5B6,00000000,003D54CB,00000000,80070656,?,?,003E4042,003D54CB,?,80070656,00000001,crypt32.dll), ref: 003D20B6
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,003EE5B6,00000000,003D54CB,00000000,80070656,?,?,003E4042,003D54CB), ref: 003D20FD

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 003D20DA

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-792799584
Opcode ID: 879052b03702cb0c3887b5a8228a111d179c7ff64764a0f2a77761591a823500
Instruction ID: ce488dbbe212d1c4a41848009b005f95e714c83c9be0e7566159fe1fb1ec5658
Opcode Fuzzy Hash: 879052b03702cb0c3887b5a8228a111d179c7ff64764a0f2a77761591a823500
Instruction Fuzzy Hash: B80161B7941129FBDB119F95ED05ADF7EACEB04750F018162BD01F7240E6358E50D6E1

Function 003F68EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,003F689A,00000000,00000003), ref: 003F6905
GetLastError.KERNEL32(?,003F689A,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,003F6C89,?), ref: 003F690F

Strings

c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 003F6933
Failed to set service start type., xrefs: 003F693D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp
API String ID: 1456623077-3535627199
Opcode ID: f77f41c2ce27bfa99e0b34b912a3c047d804a20aeeb7eed9d5ef0cbcd8449693
Instruction ID: b290e1a7b4aad48ef37bf9720ba4961c21fc3df658d9ceb257bed85845c06d6d
Opcode Fuzzy Hash: f77f41c2ce27bfa99e0b34b912a3c047d804a20aeeb7eed9d5ef0cbcd8449693
Instruction Fuzzy Hash: 39F0EC376451393386221A95BC06F9F7D48DF017707234335FF28BA2D1E6698C0082E9

Function 004034A2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040359A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 004035A4
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 004035B1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ec03c9a8faed9f4674430214e9890ca76cd87624a294e272bfcc7b770309d584
Instruction ID: 2e8778681abfea0699b1ed93535f2f0608f69b44cca6377c50f4a901d2786024
Opcode Fuzzy Hash: ec03c9a8faed9f4674430214e9890ca76cd87624a294e272bfcc7b770309d584
Instruction Fuzzy Hash: 1E31E27091121CABCB21DF24DC89799BBB8AF08310F1041EAE81CA72A0EB349B858F45

Function 00404104 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,004040DA,00000000,00437908,0000000C,00404231,00000000,00000002,00000000), ref: 00404125
TerminateProcess.KERNEL32(00000000,?,004040DA,00000000,00437908,0000000C,00404231,00000000,00000002,00000000), ref: 0040412C
ExitProcess.KERNEL32 ref: 0040413E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 904e5b256781a8f29c4b2c385a19996432205d524143638328c5a95bc68b3cdb
Instruction ID: d2eaa958c951a1a30ada3e1291f42c9a0eab829f6f0b11caa6288a2ea0ce544c
Opcode Fuzzy Hash: 904e5b256781a8f29c4b2c385a19996432205d524143638328c5a95bc68b3cdb
Instruction Fuzzy Hash: D4E04671001208AFCF016F50DD0CA993B2AEB90356F008079FA45AB262CB39DC92CB89

Function 004132B9 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00413448: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,004132E8,?), ref: 004134B9

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0041330C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0041331D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: 58ebab00f0ce365c10ca8e857e43f8cab19f257c9550d6a91d45926f24b08f5e
Instruction ID: e830143ef6edd93103bbabe2f20d59fb25a762cd01062481659d14982225e55b
Opcode Fuzzy Hash: 58ebab00f0ce365c10ca8e857e43f8cab19f257c9550d6a91d45926f24b08f5e
Instruction Fuzzy Hash: 5011397190020EEBDB10DFA5DC85BEFBBF8FF08345F50442AA551E6241D7749A84CB59

Function 00413C72 Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(003F8F6B,?,00000100,00000000,00000000), ref: 00413CAD
FindClose.KERNEL32(00000000), ref: 00413CB9

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 88419cc396713ae1979d1ec388de99b5fef544275c05675f73c4305c054b15cd
Instruction ID: a2313699186211e5b6f5b144b712c981461ff7c0cb2b692103be84f996cb0460
Opcode Fuzzy Hash: 88419cc396713ae1979d1ec388de99b5fef544275c05675f73c4305c054b15cd
Instruction Fuzzy Hash: 2E01F9726002086BDB10EF65DD89DEBB3BDEFC5325F000065F909D3280D634AE5D8798

Function 003DFF35 Relevance: 86.2, APIs: 1, Strings: 48, Instructions: 482registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 003E052B

Strings

BundleCachePath, xrefs: 003DFFD8, 003DFFDD
Failed to write %ls value., xrefs: 003E04CA
crypt32.dll, xrefs: 003E017A, 003E01BB, 003E0452, 003E0471
HelpLink, xrefs: 003E01F3, 003E0206
/modify, xrefs: 003E040D
BundleDetectCode, xrefs: 003E002F, 003E0037
UninstallString, xrefs: 003E0422, 003E0438
HelpTelephone, xrefs: 003E0219, 003E022C
BundlePatchCode, xrefs: 003E004D, 003E0055
Failed to write update registration., xrefs: 003E047E
ParentDisplayName, xrefs: 003E028B, 003E029E
VersionMinor, xrefs: 003E00D1, 003E00D7
Publisher, xrefs: 003E01CD, 003E01E0
Failed to update name and publisher., xrefs: 003E0187
3.11.2.4516, xrefs: 003E012C
%hs, xrefs: 003E0131
"%ls" %ls, xrefs: 003E041D
Failed to cache bundle from path: %ls, xrefs: 003DFF8B
VersionMajor, xrefs: 003E00A8, 003E00AE
BundleUpgradeCode, xrefs: 003DFFF3, 003DFFFB
BundleVersion, xrefs: 003E006B, 003E008E
%hu.%hu.%hu.%hu, xrefs: 003E0089
URLInfoAbout, xrefs: 003E023F, 003E0252
URLUpdateInfo, xrefs: 003E0265, 003E0278
BundleAddonCode, xrefs: 003E0011, 003E0019
"%ls" /modify, xrefs: 003E0349
EstimatedSize, xrefs: 003E04B5, 003E04BA, 003E04C9
QuietUninstallString, xrefs: 003E03E6, 003E03FC
ParentKeyName, xrefs: 003E02AB, 003E02BE
DisplayVersion, xrefs: 003E019A, 003E01AD
Failed to create registration key., xrefs: 003DFFB8
SystemComponent, xrefs: 003E03C1, 003E03D4
ModifyPath, xrefs: 003E034E, 003E0364
Contact, xrefs: 003E02FB, 003E030E
EngineVersion, xrefs: 003E0136, 003E013B
"%ls" /uninstall /quiet, xrefs: 003E03E1
BundleProviderKey, xrefs: 003E00F3, 003E00F8
NoRemove, xrefs: 003E039C, 003E03AF
Failed to register the bundle dependency key., xrefs: 003E04EC
Comments, xrefs: 003E02D3, 003E02E6
Failed to write software tags., xrefs: 003E045E
DisplayIcon, xrefs: 003E0154, 003E015E
NoElevateOnModify, xrefs: 003E0370, 003E0383
Failed to update resume mode., xrefs: 003E0506
BundleTag, xrefs: 003E0114, 003E0119
/uninstall, xrefs: 003E0414, 003E0419
%s,0, xrefs: 003E0159
NoModify, xrefs: 003E0324, 003E0337

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.2.4516$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$crypt32.dll
API String ID: 3535843008-3218910351
Opcode ID: 4f0960ab7baba2e799abc76bac77a00d29f52b7714e5384d466f10505cea8db3
Instruction ID: 1b3e2524c49150631553c4102fe40a639bf9902724e335dbeb79513d697ba1c7
Opcode Fuzzy Hash: 4f0960ab7baba2e799abc76bac77a00d29f52b7714e5384d466f10505cea8db3
Instruction Fuzzy Hash: 94F14431A41676FBDB275652ED42FA97AA4AB00714F110222FD00766D2C7F9EDE0DEC8

Function 003DCD76 Relevance: 86.1, APIs: 3, Strings: 46, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,comres.dll,00000000,0041BB64,?,00000000), ref: 003DCEAC

Strings

Failed to get @Container., xrefs: 003DD144
CertificateRootPublicKeyIdentifier, xrefs: 003DCFF6
download, xrefs: 003DCE9E
Catalog, xrefs: 003DD0A5
Failed to get @DownloadUrl., xrefs: 003DD1A1
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 003DD170
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 003DD169
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 003DCDF8
msi.dll, xrefs: 003DD018
msasn1.dll, xrefs: 003DCFDD
Failed to select payload nodes., xrefs: 003DCDA4
Failed to hex decode @CertificateRootThumbprint., xrefs: 003DD177
Failed to allocate memory for payload structs., xrefs: 003DCE02
version.dll, xrefs: 003DD01C
Failed to get @FileSize., xrefs: 003DD162
comres.dll, xrefs: 003DCE63
Failed to get @Hash., xrefs: 003DD19A
Failed to get @Catalog., xrefs: 003DD18C
Failed to get payload node count., xrefs: 003DCDC9
embedded, xrefs: 003DCEBE
Failed to parse @FileSize., xrefs: 003DD158
Failed to get @CertificateRootThumbprint., xrefs: 003DD17E
Invalid value for @Packaging: %ls, xrefs: 003DD1B7
Container, xrefs: 003DCF04
Failed to find catalog., xrefs: 003DD185
Packaging, xrefs: 003DCE7F
external, xrefs: 003DCEDA
Failed to to find container: %ls, xrefs: 003DD13D
wininet.dll, xrefs: 003DD0C7
Failed to hex decode the Payload/@Hash., xrefs: 003DD193
Failed to get @LayoutOnly., xrefs: 003DD14E
Payload, xrefs: 003DCD91
SourcePath, xrefs: 003DCF69
Failed to get @Packaging., xrefs: 003DD1CA
CertificateRootThumbprint, xrefs: 003DD033
Failed to get next node., xrefs: 003DD1DF
feclient.dll, xrefs: 003DCF45
Failed to get @SourcePath., xrefs: 003DD1A8
DownloadUrl, xrefs: 003DCF92
Hash, xrefs: 003DD070
Failed to get @Id., xrefs: 003DD1D8
FilePath, xrefs: 003DCE64
LayoutOnly, xrefs: 003DCF46
Failed to get @FilePath., xrefs: 003DD1D1
cabinet.dll, xrefs: 003DD059
FileSize, xrefs: 003DCFBB

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\66\s\src\burn\engine\payload.cpp$cabinet.dll$comres.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 1171520630-3125196775
Opcode ID: 92f5c78891afeb8572fdae1e036d6825d0722b2d020ea6ba45b52f7d5713715e
Instruction ID: e20b81179934c6ca9c54dbff3b6dcd6c017e4e1a9e843856d044d6f4fe050a71
Opcode Fuzzy Hash: 92f5c78891afeb8572fdae1e036d6825d0722b2d020ea6ba45b52f7d5713715e
Instruction Fuzzy Hash: 09C1E37795022AFBCB129A51ED01FEDBB68EB00710F210267FD11BB680D774AE91D794

Function 003D8463 Relevance: 63.3, APIs: 5, Strings: 31, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,msasn1.dll,00000000,80070490,?,?,?,?,?,?,?,BT=,003FBEAE,0041A570,?,0041A594), ref: 003D8494
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,BT=,003FBEAE,0041A570,?,0041A594,?,?,Chain), ref: 003D87F7

Strings

Failed to find variable value '%ls'., xrefs: 003D87C5
Failed to set value of variable: %ls, xrefs: 003D879A
version, xrefs: 003D8619
Initializing version variable '%ls' to value '%ls', xrefs: 003D8640
string, xrefs: 003D85E4
Failed to select variable nodes., xrefs: 003D84B1
msasn1.dll, xrefs: 003D8470
Failed to get @Persisted., xrefs: 003D87D4
Attempt to set built-in variable value: %ls, xrefs: 003D87BB
Failed to insert variable '%ls'., xrefs: 003D8789
Hidden, xrefs: 003D851C
numeric, xrefs: 003D85A9
BT=, xrefs: 003D8463
Type, xrefs: 003D8590
Value, xrefs: 003D8552
Failed to get @Type., xrefs: 003D8771
Variable, xrefs: 003D849E
Initializing string variable '%ls' to value '%ls', xrefs: 003D8607
Invalid value for @Type: %ls, xrefs: 003D875E
Failed to get next node., xrefs: 003D87E9
Failed to set variant encryption, xrefs: 003D8790
Failed to get @Id., xrefs: 003D87E2
Persisted, xrefs: 003D8537
Failed to change variant type., xrefs: 003D87CD
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D87AC
Initializing numeric variable '%ls' to value '%ls', xrefs: 003D85CF
Failed to set variant value., xrefs: 003D8778
Failed to get variable node count., xrefs: 003D84CE
Failed to get @Value., xrefs: 003D877F
Failed to get @Hidden., xrefs: 003D87DB
Initializing hidden variable '%ls', xrefs: 003D865E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$BT=$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\66\s\src\burn\engine\variable.cpp$msasn1.dll$numeric$string$version
API String ID: 3168844106-2009391729
Opcode ID: 1cefec2bd41eefa1b6567018be12647f85d1205105baf3dbbbb69dc888ce8dca
Instruction ID: c3aa38f7b32f9a1f27b0e5efec435f322b772a2e043fee69fd6cca76257e898c
Opcode Fuzzy Hash: 1cefec2bd41eefa1b6567018be12647f85d1205105baf3dbbbb69dc888ce8dca
Instruction Fuzzy Hash: 83B1C073D00219BBCB139B94EC45EEEBB79EF44720F314167F910BA291DB74AA409B94

Function 003F6A2D Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 378COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,003EBC99,00000007,?,?,?), ref: 003F6A81

Part of subcall function 0041038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,003D5EE0,00000000), ref: 0041039E
Part of subcall function 0041038A: GetProcAddress.KERNEL32(00000000), ref: 004103A5
Part of subcall function 0041038A: GetLastError.KERNEL32(?,?,?,003D5EE0,00000000), ref: 004103BC

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 003F6E70
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 003F6E84

Strings

/log:, xrefs: 003F6C03
Failed to ensure WU service was enabled to install MSU package., xrefs: 003F6C8F
WixBundleExecutePackageCacheFolder, xrefs: 003F6B6C, 003F6E9C
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 003F6CEE, 003F6D83, 003F6DAB
SysNative\, xrefs: 003F6ACB
"%ls" "%ls" /quiet /norestart, xrefs: 003F6BA9
wusa.exe, xrefs: 003F6B01
Failed to append log switch to MSU command-line., xrefs: 003F6C17
Failed to format MSU uninstall command., xrefs: 003F6BEA
Failed to get process exit code., xrefs: 003F6D8D
D, xrefs: 003F6C9C
2, xrefs: 003F6D14
Failed to format MSU install command., xrefs: 003F6BBD
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 003F6BD6
Failed to find System32 directory., xrefs: 003F6AF6
Failed to find Windows directory., xrefs: 003F6AC0
Failed to get action arguments for MSU package., xrefs: 003F6B37
Failed to wait for executable to complete: %ls, xrefs: 003F6DFF
Failed to determine WOW64 status., xrefs: 003F6A93
Failed to allocate WUSA.exe path., xrefs: 003F6B14
Failed to CreateProcess on path: %ls, xrefs: 003F6CFB
Failed to build MSU path., xrefs: 003F6B96
Bootstrapper application aborted during MSU progress., xrefs: 003F6DB5
Failed to append log path to MSU command-line., xrefs: 003F6C35
Failed to append SysNative directory., xrefs: 003F6ADE
Failed to get cached path for package: %ls, xrefs: 003F6B5D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wusa.exe
API String ID: 1400713077-2603125353
Opcode ID: 61e51b60f22e746cb2cbb39f27d2e043cbdcd0b851e9a04fe3b949281f4ebe58
Instruction ID: 71b5878ca4a46058db6e5ce284318d8a8f62d7de66fc73096c5cf7837dbbb1ff
Opcode Fuzzy Hash: 61e51b60f22e746cb2cbb39f27d2e043cbdcd0b851e9a04fe3b949281f4ebe58
Instruction Fuzzy Hash: 81D18D71B0031EABDF139FE4DD86BBE7AB8AF18700F204136B700B6161D7B5AA449B55

Function 003E545D Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,0041A500,?,00000000,?,003D457C,?,0041A500), ref: 003E547E
GetCurrentProcessId.KERNEL32(?,003D457C,?,0041A500), ref: 003E5489
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,003D457C,?,0041A500), ref: 003E54C0
ConnectNamedPipe.KERNEL32(?,00000000,?,003D457C,?,0041A500), ref: 003E54D5
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E54DF
Sleep.KERNEL32(00000064,?,003D457C,?,0041A500), ref: 003E5514
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,003D457C,?,0041A500), ref: 003E5537
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,003D457C,?,0041A500), ref: 003E5552
WriteFile.KERNEL32(?,|E=,0041A500,00000000,00000000,?,003D457C,?,0041A500), ref: 003E556D
WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,003D457C,?,0041A500), ref: 003E5588
ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,003D457C,?,0041A500), ref: 003E55A3
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E55FE
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E5632
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E5666
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E569A
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E56CB
GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E56FC

Strings

wininet.dll, xrefs: 003E55A1
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E55EA, 003E561E, 003E5652, 003E5686, 003E56BA, 003E56EB, 003E571C
crypt32.dll, xrefs: 003E5550
Failed to write secret to pipe., xrefs: 003E5690
Failed to write secret length to pipe., xrefs: 003E56C4
Failed to set pipe to non-blocking., xrefs: 003E5726
Failed to write our process id to pipe., xrefs: 003E565C
Failed to wait for child to connect to pipe., xrefs: 003E55F4
feclient.dll, xrefs: 003E5580, 003E559B
Failed to reset pipe to blocking., xrefs: 003E56F5
comres.dll, xrefs: 003E5586
Failed to read ACK from pipe., xrefs: 003E5628
|E=, xrefs: 003E5569

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$comres.dll$crypt32.dll$feclient.dll$wininet.dll$|E=
API String ID: 2944378912-2401361368
Opcode ID: 613ab8d0d79e552b9c2e76e676756c43a3d5118a25378f809288809109a9ae01
Instruction ID: 5a58442177b8b7fa57f2bae4d3b57df423b34c39cc783533d0ded50da3b98392
Opcode Fuzzy Hash: 613ab8d0d79e552b9c2e76e676756c43a3d5118a25378f809288809109a9ae01
Instruction Fuzzy Hash: 55610C77E41635B7D722DAA69C05FAEB6A86F00B55F224222BD01FF2C0D678DD0087E5

Function 003FD10E Relevance: 49.3, APIs: 12, Strings: 16, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 003FD183
StringFromGUID2.OLE32(?,?,00000027), ref: 003FD1AC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 003FD295
GetLastError.KERNEL32(?,?,?,?), ref: 003FD29F
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 003FD338
WaitForSingleObject.KERNEL32(0041A500,000000FF,?,?,?,?), ref: 003FD343
ReleaseMutex.KERNEL32(0041A500,?,?,?,?), ref: 003FD36D
GetExitCodeProcess.KERNEL32(?,?), ref: 003FD38E
GetLastError.KERNEL32(?,?,?,?), ref: 003FD39C
GetLastError.KERNEL32(?,?,?,?), ref: 003FD3D4

Part of subcall function 003FD016: WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,003FD312,?), ref: 003FD035
Part of subcall function 003FD016: ReleaseMutex.KERNEL32(?,?,?,003FD312,?), ref: 003FD049
Part of subcall function 003FD016: WaitForSingleObject.KERNEL32(?,000000FF), ref: 003FD08E
Part of subcall function 003FD016: ReleaseMutex.KERNEL32(?), ref: 003FD0A1
Part of subcall function 003FD016: SetEvent.KERNEL32(?), ref: 003FD0AA

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 003FD47D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 003FD495

Strings

Failed to create netfx chainer guid., xrefs: 003FD190
%ls /pipe %ls, xrefs: 003FD24F
Failed to convert netfx chainer guid into string., xrefs: 003FD1CB
Failed to allocate event name., xrefs: 003FD20F
Failed to allocate netfx chainer arguments., xrefs: 003FD263
D, xrefs: 003FD27A
Failed to get netfx return code., xrefs: 003FD3CA
NetFxSection.%ls, xrefs: 003FD1D9
Failed to CreateProcess on path: %ls, xrefs: 003FD2CE
Failed to create netfx chainer., xrefs: 003FD22E
Failed to process netfx chainer message., xrefs: 003FD318
NetFxEvent.%ls, xrefs: 003FD1FB
Failed to allocate section name., xrefs: 003FD1ED
Failed to wait for netfx chainer process to complete, xrefs: 003FD402
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 003FD1C1, 003FD2C3, 003FD3C0, 003FD3F8
!?, xrefs: 003FD13D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$!?
API String ID: 1533322865-1517683286
Opcode ID: 78778d4599c450f66a8db2283e55be8471253b46ff7daf95e3a861936d13eef3
Instruction ID: 36b718c9a63dfabd252f858d25189091a2f29edda75bbffbcf66a065b7733162
Opcode Fuzzy Hash: 78778d4599c450f66a8db2283e55be8471253b46ff7daf95e3a861936d13eef3
Instruction Fuzzy Hash: 79A1A032E4022CABDB22DBA4DC49BAEB7B9BB04310F514176EE09FB251D7359D448F91

Function 00416C19 Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00416D2C
SysFreeString.OLEAUT32(00000000), ref: 00416EF5
SysFreeString.OLEAUT32(00000000), ref: 00416F92

Strings

subtitle, xrefs: 00416D9B
icon, xrefs: 00416D43
link, xrefs: 00416CC1, 00416EA3
author, xrefs: 00416C6A, 00416DFB
category, xrefs: 00416C87, 00416E34
updated, xrefs: 00416DD3
logo, xrefs: 00416D7F
@, xrefs: 00416E9B
title, xrefs: 00416DB7
(, xrefs: 00416ED0
`<u, xrefs: 00416EF5, 00416F92
entry, xrefs: 00416CA4, 00416E6D
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00416C46, 00416F7C
generator, xrefs: 00416D1F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`<u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-2833164091
Opcode ID: cee513dba5997d1b3ce12c4c2e2159592012d6ed796d7852a06bff5d4658d1f7
Instruction ID: b90332d89e19ddbaf316f6bac59edfe75fc83483e1668c78699f760c1296cba0
Opcode Fuzzy Hash: cee513dba5997d1b3ce12c4c2e2159592012d6ed796d7852a06bff5d4658d1f7
Instruction Fuzzy Hash: 65B1D231A44216BBCB119B64DC41FEEB778AF04724F324356F524AA2D1C778EE81CB98

Function 004168DE Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 297COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00436470,000000FF,?,?,?), ref: 004169A5
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 004169CA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 004169EA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00416A06
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00416A2E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00416A4A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 00416A83
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00416ABC

Part of subcall function 00416527: SysFreeString.OLEAUT32(00000000), ref: 00416660
Part of subcall function 00416527: SysFreeString.OLEAUT32(00000000), ref: 0041669F

SysFreeString.OLEAUT32(00000000), ref: 00416B40
SysFreeString.OLEAUT32(00000000), ref: 00416BF0

Strings

clbcatq.dll, xrefs: 00416A13
link, xrefs: 00416943, 00416AEE
(, xrefs: 00416B1B
author, xrefs: 00416909, 00416A3C
category, xrefs: 00416926, 00416A75
updated, xrefs: 00416A20
msi.dll, xrefs: 00416908
feclient.dll, xrefs: 004169D7
version.dll, xrefs: 00416904
published, xrefs: 004169F8
title, xrefs: 004169DC
summary, xrefs: 004169BC
`<u, xrefs: 00416B40, 00416BF0
content, xrefs: 00416AAE
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00416BDD
cabinet.dll, xrefs: 00416921

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`<u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-1823403471
Opcode ID: e1b048cbd4eeccd6831d35f8aca3b4a04f832f812c8cd0c16148b1676b903a1f
Instruction ID: 13e8316f94c0da433fc4af4f6e92df8527528e3289d6126f9e5e5a6ebc16d3bc
Opcode Fuzzy Hash: e1b048cbd4eeccd6831d35f8aca3b4a04f832f812c8cd0c16148b1676b903a1f
Instruction Fuzzy Hash: 1DA1B371A08226BBCB119B54CC41FEE7764AF04724F224367F521EA2D1C778EA90DB98

Function 003DA3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003DA418
_MREFOpen@16.MSPDB140-MSVCRT ref: 003DA440
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 003DA73F

Strings

Failed to format key string., xrefs: 003DA425
Failed to query registry key value size., xrefs: 003DA51C
Unsupported registry key value type. Type = '%u', xrefs: 003DA5D2
Failed to get expand environment string., xrefs: 003DA6AD
Failed to set variable., xrefs: 003DA701
Failed to clear variable., xrefs: 003DA49E
Failed to open registry key., xrefs: 003DA4B3
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 003DA717
Failed to allocate memory registry value., xrefs: 003DA54F
Failed to query registry key value., xrefs: 003DA5A4
Registry key not found. Key = '%ls', xrefs: 003DA478
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 003DA4E2
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 003DA510, 003DA545, 003DA598, 003DA6A1
Failed to allocate string buffer., xrefs: 003DA633
Failed to change value type., xrefs: 003DA6E3, 003DA706
Failed to format value string., xrefs: 003DA44D
Failed to read registry value., xrefs: 003DA6C8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 2348241696-2754605460
Opcode ID: 90830bd740b66325047cc0a8ee99c37370296f187a3ae50e82554ec5657604d2
Instruction ID: 4dc150a9ca0e49f127db254afd389be00cfdb156808e257577a24b517d0495fd
Opcode Fuzzy Hash: 90830bd740b66325047cc0a8ee99c37370296f187a3ae50e82554ec5657604d2
Instruction Fuzzy Hash: 86A1D273E00925BBCF239AE4EA05AEE7A79AF08710F158123F901BA350D774DD1097E6

Function 003D57A7 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,003DA889,00000100,000002C0,000002C0,00000100), ref: 003D57CC
lstrlenW.KERNEL32(000002C0,?,003DA889,00000100,000002C0,000002C0,00000100), ref: 003D57D6
_wcschr.LIBVCRUNTIME ref: 003D59DB
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,003DA889,00000100,000002C0,000002C0,00000100), ref: 003D5C7E

Strings

Failed to allocate variable array., xrefs: 003D5AB9
Failed to append string., xrefs: 003D5852
Failed to get formatted length., xrefs: 003D5BC6
Failed to reallocate variable array., xrefs: 003D5A60
Failed to allocate record., xrefs: 003D5A3F
Failed to allocate buffer for format string., xrefs: 003D57F4
Failed to determine variable visibility: '%ls'., xrefs: 003D5A6E
Failed to append placeholder., xrefs: 003D5A81
Failed to copy string., xrefs: 003D5C62
[%d], xrefs: 003D5996
Failed to format placeholder string., xrefs: 003D5A8B
Failed to allocate string., xrefs: 003D5BF5
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D5A32, 003D5A53, 003D5AAC, 003D5AFE, 003D5B8A, 003D5BBC, 003D5C38
Failed to set record string., xrefs: 003D5B94
Failed to set variable value., xrefs: 003D5A95
Failed to set record format string., xrefs: 003D5B08
Failed to get variable name., xrefs: 003D5AC0
*****, xrefs: 003D594D
Failed to format record., xrefs: 003D5C42

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1026845265-1173883696
Opcode ID: c77b732267fb1dc66a42e68af86ef3bd5646097e17f52732103633d61b38a0c0
Instruction ID: a68d1758bd3d189f57659795375e4d4d665431887556645f77fe0fe9dd54b75c
Opcode Fuzzy Hash: c77b732267fb1dc66a42e68af86ef3bd5646097e17f52732103633d61b38a0c0
Instruction Fuzzy Hash: 91F1C273D40625ABDB129F64AC41EBF7B78EB00B50F15812BFD15AB340D7389E409BA4

Function 003FCB5D Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 239synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,003FD228,?,?,?), ref: 003FCBA3
GetLastError.KERNEL32(?,?,003FD228,?,?,?), ref: 003FCBB0
ReleaseMutex.KERNEL32(?), ref: 003FCE18

Strings

failed to allocate memory for event name, xrefs: 003FCBF6
Failed to create event: %ls, xrefs: 003FCC43
Failed to memory map cabinet file: %ls, xrefs: 003FCD04
Failed to create mutex: %ls, xrefs: 003FCCB2
%ls_mutex, xrefs: 003FCC51
%ls_send, xrefs: 003FCBE2
failed to copy event name to shared memory structure., xrefs: 003FCD76
Failed to allocate memory for NetFxChainer struct., xrefs: 003FCB89
failed to allocate memory for mutex name, xrefs: 003FCC65
Failed to MapViewOfFile for %ls., xrefs: 003FCD4C
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 003FCB7F, 003FCBD1, 003FCC36, 003FCCA5, 003FCCF7, 003FCD3F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2874813099
Opcode ID: d40e20a7fce9a368956093bef220428882732389c43d80f9397727a53f75ec87
Instruction ID: 1c06d2a2da334dfcbcb37be9ff05e5b0dc8f372a20b45586f570402f30d89761
Opcode Fuzzy Hash: d40e20a7fce9a368956093bef220428882732389c43d80f9397727a53f75ec87
Instruction Fuzzy Hash: 66813772A9173ABBC3238B649D09FAA7EA4BF04710F524175FE08AB351D638DD00C6E5

Function 003DE9FC Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00412B5D: VariantInit.OLEAUT32(0041A594), ref: 00412B73
Part of subcall function 00412B5D: SysAllocString.OLEAUT32(?), ref: 00412B8F
Part of subcall function 00412B5D: VariantClear.OLEAUT32(?), ref: 00412C16
Part of subcall function 00412B5D: SysFreeString.OLEAUT32(00000000), ref: 00412C21

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,0041BB64,?,?,Action,?,?,?,00000000,?), ref: 003DEACD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 003DEB17

Strings

Failed to resize Addon code array in registration, xrefs: 003DEBF6
Action, xrefs: 003DEA8A
Failed to resize Patch code array in registration, xrefs: 003DEBFD
version.dll, xrefs: 003DEB2A
Failed to resize Upgrade code array in registration, xrefs: 003DEBEF
Addon, xrefs: 003DEB54
comres.dll, xrefs: 003DEAE0
Failed to get next RelatedBundle element., xrefs: 003DEC2A
Failed to resize Detect code array in registration, xrefs: 003DEBE8
Failed to get @Id., xrefs: 003DEC1C
Invalid value for @Action: %ls, xrefs: 003DEC0C
Detect, xrefs: 003DEABE
Patch, xrefs: 003DEB97
RelatedBundle, xrefs: 003DEA0A
cabinet.dll, xrefs: 003DEB74
Failed to get RelatedBundle element count., xrefs: 003DEA51
Upgrade, xrefs: 003DEB0A
Failed to get @Action., xrefs: 003DEC23
Failed to get RelatedBundle nodes, xrefs: 003DEA2C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: a28cf6c26f3f0930195c58f10a6fa3d8b855aac6354295c7bd81b561caac3df0
Instruction ID: 9d105a847652d69bfadcc88fb44201a5bb12585f95e7a8404043ef8b9b78c897
Opcode Fuzzy Hash: a28cf6c26f3f0930195c58f10a6fa3d8b855aac6354295c7bd81b561caac3df0
Instruction Fuzzy Hash: E071C432A44626BBC711EF50D941EADBBB4FB04724F204217E911BB791C734AE51CB94

Function 003E4668 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,003E4B7B,0041A4E8,?,feclient.dll,00000000,?,?), ref: 003E467F
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,003E4B7B,0041A4E8,?,feclient.dll,00000000,?,?), ref: 003E46A0
GetLastError.KERNEL32(?,003E4B7B,0041A4E8,?,feclient.dll,00000000,?,?), ref: 003E46A6
ReadFile.KERNEL32(feclient.dll,00000000,0041A518,?,00000000,00000000,0041A519,?,003E4B7B,0041A4E8,?,feclient.dll,00000000,?,?), ref: 003E4734
GetLastError.KERNEL32(?,003E4B7B,0041A4E8,?,feclient.dll,00000000,?,?), ref: 003E473A

Strings

c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E46CA, 003E46F5, 003E475E, 003E4796, 003E47E3, 003E483D, 003E487B
Verification secret from parent does not match., xrefs: 003E47A2
Failed to read size of verification secret from parent pipe., xrefs: 003E46D4
Failed to read verification secret from parent pipe., xrefs: 003E4768
Failed to read verification process id from parent pipe., xrefs: 003E47ED
Failed to allocate buffer for verification secret., xrefs: 003E471D
Verification secret from parent is too big., xrefs: 003E4701
Verification process id from parent does not match., xrefs: 003E4887
msasn1.dll, xrefs: 003E47B7
feclient.dll, xrefs: 003E466E, 003E469E, 003E469F, 003E4733, 003E47B8, 003E480E
Failed to inform parent process that child is running., xrefs: 003E4847

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$feclient.dll$msasn1.dll
API String ID: 1233551569-1273669510
Opcode ID: fc5a66890119d719ea412026e64d3b3bcadb16980b9de7d7375d030e8776420f
Instruction ID: f5a7fcfd9dc5ac00d30a10f5a17ba623986a60151c975f3d84c27e3d8c6bd31d
Opcode Fuzzy Hash: fc5a66890119d719ea412026e64d3b3bcadb16980b9de7d7375d030e8776420f
Instruction Fuzzy Hash: FF510837E40276B7D7139E965C41FAE7A78AF05B11F224226BE10BB2C0D77C9E0096E5

Function 003F2596 Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

Failed to get @DetectCondition., xrefs: 003F25BF
netfx4, xrefs: 003F26AF
Failed to get @InstallArguments., xrefs: 003F25E1
burn, xrefs: 003F267A
RepairArguments, xrefs: 003F2614
UninstallArguments, xrefs: 003F25F2
Repairable, xrefs: 003F2636
Failed to get @UninstallArguments., xrefs: 003F2603
none, xrefs: 003F26D0
Protocol, xrefs: 003F265D
Failed to parse exit codes., xrefs: 003F26A6
Failed to get @Repairable., xrefs: 003F264F
InstallArguments, xrefs: 003F25D0
Failed to get @Protocol., xrefs: 003F270E
DetectCondition, xrefs: 003F25AE
Failed to get @RepairArguments., xrefs: 003F2625
Invalid protocol type: %ls, xrefs: 003F26F6
Failed to parse command lines., xrefs: 003F2722

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: e6835e56fa492066ae8f4baf751bf38b9d2df497c1af9bf1c56a2d3c376eb9cf
Instruction ID: 6cdaf1a9673b8e2ff028da94cf3256f37141ede00afbb0aae0c003a2a0b20649
Opcode Fuzzy Hash: e6835e56fa492066ae8f4baf751bf38b9d2df497c1af9bf1c56a2d3c376eb9cf
Instruction Fuzzy Hash: D841D931B8473AF7C713A5649D42F7B76589B01730F310316FE24F62C2D7A8A914469A

Function 003D8F3F Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,560041CC,00000001,?,003D990B,?,00000000,00000000,?,?,003D98F3,?,?,00000000,?), ref: 003D8F7D

Strings

Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 003D93D5
NOT, xrefs: 003D92A8
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 003D912F
AND, xrefs: 003D9289
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 003D920F
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 003D9065
Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 003D91AB
-, xrefs: 003D90E5
Failed to set symbol value., xrefs: 003D902D
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 003D9391
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 003D934D
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 003D9051, 003D911B, 003D9197, 003D91FB, 003D9339, 003D937D, 003D93C1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 4177115715-1494984065
Opcode ID: 77c97b618c90362e2e7b188bd9bb0642a2419505e55e1901a756b52cabf0aa48
Instruction ID: 9ed8953fed2b09df3f86fb076a02406dc8a1a93b8809fc63e33cd7cd81a61ac4
Opcode Fuzzy Hash: 77c97b618c90362e2e7b188bd9bb0642a2419505e55e1901a756b52cabf0aa48
Instruction Fuzzy Hash: BBF1F5B2540315FBDB16CF55E889BEA7B78FB04704F10854BF9019A786C3B9DA96CB80

Function 003E6AC2 Relevance: 35.4, APIs: 6, Strings: 14, Instructions: 355synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 003DD461: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,003E6F37,000000B8,00000000,?,00000000,75C0B390), ref: 003DD470
Part of subcall function 003DD461: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 003DD47F
Part of subcall function 003DD461: LeaveCriticalSection.KERNEL32(000000D0,?,003E6F37,000000B8,00000000,?,00000000,75C0B390), ref: 003DD494

ReleaseMutex.KERNEL32(00000000,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 003E6E86
CloseHandle.KERNEL32(00000000), ref: 003E6E8F
CloseHandle.KERNEL32(?,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 003E6EAF

Part of subcall function 003FB9F8: SetThreadExecutionState.KERNEL32(80000001), ref: 003FB9FD

Strings

Failed to create cache thread., xrefs: 003E6D65
crypt32.dll, xrefs: 003E6BC6
Another per-machine setup is already executing., xrefs: 003E6CC8
Failed to elevate., xrefs: 003E6C8E
UX aborted apply begin., xrefs: 003E6B94
Failed to register bundle., xrefs: 003E6CEB
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 003E6B8A, 003E6D5B
Another per-user setup is already executing., xrefs: 003E6BD4
comres.dll, xrefs: 003E6ED5
Failed to set initial apply variables., xrefs: 003E6BFE
Failed to cache engine to working directory., xrefs: 003E6C68
oE=, xrefs: 003E6DC2, 003E6D0E, 003E6DC5
Failed while caching, aborting execution., xrefs: 003E6D8D
Engine cannot start apply because it is busy with another action., xrefs: 003E6B23

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeExecutionInterlockedLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$c:\agent\_work\66\s\src\burn\engine\core.cpp$comres.dll$crypt32.dll$oE=
API String ID: 1740103319-3083614541
Opcode ID: 5a455ff4c92d9e531b2c61ef4ad60193a3498d9ce9f64835a452a58a192c002e
Instruction ID: ee82d53cb9e916cb4e4b74fbee5dc166da14ee97761ccb8333ebfe5862d5245d
Opcode Fuzzy Hash: 5a455ff4c92d9e531b2c61ef4ad60193a3498d9ce9f64835a452a58a192c002e
Instruction Fuzzy Hash: 61C1D6B1900275EBDF169F61CC86BEE3AA8EF54350F14427AFD05AE2C1DB349944CBA4

Function 003F1951 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 003F1A58
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 003F1A76

Strings

ExitCode, xrefs: 003F195F
Failed to parse @Code value: %ls, xrefs: 003F1B31
Invalid exit code type: %ls, xrefs: 003F1B47
Type, xrefs: 003F1A30
Failed to get @Type., xrefs: 003F1B57
Failed to allocate memory for exit code structs., xrefs: 003F19E3
Failed to get next node., xrefs: 003F1B5E
Failed to get @Code., xrefs: 003F1B38
error, xrefs: 003F1A69
success, xrefs: 003F1A49
scheduleReboot, xrefs: 003F1A85
Failed to get exit code node count., xrefs: 003F19A3
c:\agent\_work\66\s\src\burn\engine\exeengine.cpp, xrefs: 003F19D9
forceReboot, xrefs: 003F1AA3
Failed to select exit code nodes., xrefs: 003F197E
Code, xrefs: 003F1AC5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$c:\agent\_work\66\s\src\burn\engine\exeengine.cpp$error$forceReboot$scheduleReboot$success
API String ID: 2664528157-2974551199
Opcode ID: ae21e21d802190f9fa490a97e79aae72d0c8e94d1b48033f9aad1ce8117fd854
Instruction ID: f6cd1149c825f5996fb71b8fafe13aaae15948d0c85a9d484090c4ed0c6d1165
Opcode Fuzzy Hash: ae21e21d802190f9fa490a97e79aae72d0c8e94d1b48033f9aad1ce8117fd854
Instruction Fuzzy Hash: B161F631A0422AFBCF129B55EC41EBEBBA5EF00720F314266F924AB2D0D7749E40D785

Function 00416FC4 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 205COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00417024
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00417049
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00417069
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 0041709C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 004170B8
SysFreeString.OLEAUT32(00000000), ref: 004170E3
SysFreeString.OLEAUT32(00000000), ref: 0041715A
SysFreeString.OLEAUT32(00000000), ref: 004171A6

Strings

comres.dll, xrefs: 00417073
title, xrefs: 0041708E
length, xrefs: 0041705B
`<u, xrefs: 004170E3, 0041715A, 004171A6
rel, xrefs: 00417017
msi.dll, xrefs: 00417142
msasn1.dll, xrefs: 00417194
feclient.dll, xrefs: 00417056
href, xrefs: 0041703B
type, xrefs: 004170AA
version.dll, xrefs: 004170C7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$Compare$Free
String ID: `<u$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-782967201
Opcode ID: db814256f0a46b21b15971215e7906e115426712a46322262c992132a29d99de
Instruction ID: b5bdf9c5053c1bbc96f5a9196e33058d2d399318bd2e7a00bc7df74adb6cce11
Opcode Fuzzy Hash: db814256f0a46b21b15971215e7906e115426712a46322262c992132a29d99de
Instruction Fuzzy Hash: D3615731904219FBCB11DB94CC45FEEBBB4AF09320F204266F511A72D1D7399E90DB54

Function 004178F7 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 308COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00417924
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 0041793F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 004179E2
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,0041A518,00000000), ref: 00417A21
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00417A74
CompareStringW.KERNEL32(0000007F,00000000,0041A518,000000FF,true,000000FF), ref: 00417A92
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00417ACA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00417C0E

Strings

upgrade, xrefs: 004179D4
application, xrefs: 00417931
version, xrefs: 00417A13, 00417ABC
http://appsyndication.org/2006/appsyn, xrefs: 00417917
true, xrefs: 00417A84
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 00417B31
exclusive, xrefs: 00417A66
enclosure, xrefs: 00417BFC
type, xrefs: 0041796A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3624447555
Opcode ID: ee734b1555ff6f2e4ffeb9e1c9dc04bef962e36e53fa0edd71f4c56f9ed65891
Instruction ID: e6351bcd862be7bef73072e3bef398b4d496612207870648ba02a0539eb04a6e
Opcode Fuzzy Hash: ee734b1555ff6f2e4ffeb9e1c9dc04bef962e36e53fa0edd71f4c56f9ed65891
Instruction Fuzzy Hash: 56B1DF71548202ABDB218F58CC85F9A77B5AF04730F21861AF935AB3D5E778E981CB48

Function 003EE226 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003EE10F: LoadBitmapW.USER32(?,00000001), ref: 003EE145
Part of subcall function 003EE10F: GetLastError.KERNEL32 ref: 003EE151

LoadCursorW.USER32(00000000,00007F00), ref: 003EE287
RegisterClassW.USER32(?), ref: 003EE29B
GetLastError.KERNEL32 ref: 003EE2A6
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 003EE3AB
DeleteObject.GDI32(00000000), ref: 003EE3BA

Strings

Unexpected return value from message pump., xrefs: 003EE395
WixBurnSplashScreen, xrefs: 003EE294, 003EE3A6
c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 003EE2CA, 003EE333
Failed to create window., xrefs: 003EE33D
Failed to load splash screen., xrefs: 003EE25F
Failed to register window., xrefs: 003EE2D4

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 164797020-1158544062
Opcode ID: 672de4807c76b9432ee2a0bdacfd55d3dc637eef2438cdae6aec0e39b24aa993
Instruction ID: 42c939b2615152c6494e05c804f80e179dba9deb9be69078ace111c3995bbf3c
Opcode Fuzzy Hash: 672de4807c76b9432ee2a0bdacfd55d3dc637eef2438cdae6aec0e39b24aa993
Instruction Fuzzy Hash: 7F41B076901279BFDB129BE5DD09FAEBB79FF04700F114225FA00A7190D734AD148BA6

Function 003F9B0F Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 232threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,003FB978,00000000,000000FF,00000001,00000000,00000000,003FB978,00000001,?), ref: 003F9B74
GetLastError.KERNEL32 ref: 003F9CE4
GetExitCodeThread.KERNEL32(?,00000001), ref: 003F9D24
GetLastError.KERNEL32 ref: 003F9D2E

Strings

Failed to execute MSP package., xrefs: 003F9BF9
Failed to execute EXE package., xrefs: 003F9BAB
Failed to wait for cache check-point., xrefs: 003F9D15
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 003F9D0B, 003F9D55
Failed to get cache thread exit code., xrefs: 003F9D5F
Failed to execute dependency action., xrefs: 003F9C64
Failed to execute MSU package., xrefs: 003F9C29
Failed to execute compatible package action., xrefs: 003F9CA1
Invalid execute action., xrefs: 003F9D84
Cache thread exited unexpectedly., xrefs: 003F9D75
Failed to execute package provider registration action., xrefs: 003F9C45
Failed to execute MSI package., xrefs: 003F9BD4
Failed to load compatible package on per-machine package., xrefs: 003F9C8A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$c:\agent\_work\66\s\src\burn\engine\apply.cpp
API String ID: 3703294532-2335230991
Opcode ID: d39688663973cc784d8316f2eb0935829c735bb2b76593130a79a102a4fadf18
Instruction ID: cebda9722a895b4781ae9f211f80e3c9aff226d26df5ef717110c09d5531ed15
Opcode Fuzzy Hash: d39688663973cc784d8316f2eb0935829c735bb2b76593130a79a102a4fadf18
Instruction Fuzzy Hash: C1716D71A41229EBDB12DF65DD41FBE7BB8EB44710F2141ABFA04EB340D2749E009BA5

Function 003DF1BA Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00413349: GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00413398

RegCloseKey.ADVAPI32(00000000,?,0041FF38,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 003DF3EA

Part of subcall function 00410D39: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,003DF237,0041FF38,Resume,00000005,?,00000000,00000000,00000000), ref: 00410D4E

Strings

Failed to create run key., xrefs: 003DF2C7
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 003DF36E, 003DF3BC
Failed to write resume command line value., xrefs: 003DF307
BundleResumeCommandLine, xrefs: 003DF2F2, 003DF385
Failed to format resume command line for RunOnce., xrefs: 003DF2A3
Failed to write run key value., xrefs: 003DF2E5
"%ls" /%ls, xrefs: 003DF28F
burn.runonce, xrefs: 003DF284
Resume, xrefs: 003DF22C
Failed to delete resume command line value., xrefs: 003DF3C6
Failed to write Installed value., xrefs: 003DF260
Installed, xrefs: 003DF24F
Failed to write Resume value., xrefs: 003DF23D
Failed to delete run key value., xrefs: 003DF378

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 2348918689-1350441746
Opcode ID: b298fb08401b754557c21de84f02f6b092526cffb2f222e9aecd2bb70469c207
Instruction ID: d117d87b5257b4f645356ba15abf513c0cde1cf56ede5ad8113a35580025f592
Opcode Fuzzy Hash: b298fb08401b754557c21de84f02f6b092526cffb2f222e9aecd2bb70469c207
Instruction Fuzzy Hash: E951E937A40335BFCF239AA1FC85BAE7A64BF00714F160537B90276291D7B89D5096D4

Function 003FC96F Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(74DE8FB0,00000000,00000000), ref: 003FC97B

Part of subcall function 003E4D1A: UuidCreate.RPCRT4(?), ref: 003E4D4D

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,003F219D,?,?,00000000,?,?,?), ref: 003FCA59
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 003FCA63
GetProcessId.KERNEL32(003F219D,?,?,00000000,?,?,?,?), ref: 003FCA9B

Part of subcall function 003E545D: lstrlenW.KERNEL32(?,?,00000000,?,0041A500,?,00000000,?,003D457C,?,0041A500), ref: 003E547E
Part of subcall function 003E545D: GetCurrentProcessId.KERNEL32(?,003D457C,?,0041A500), ref: 003E5489
Part of subcall function 003E545D: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,003D457C,?,0041A500), ref: 003E54C0
Part of subcall function 003E545D: ConnectNamedPipe.KERNEL32(?,00000000,?,003D457C,?,0041A500), ref: 003E54D5
Part of subcall function 003E545D: GetLastError.KERNEL32(?,003D457C,?,0041A500), ref: 003E54DF
Part of subcall function 003E545D: Sleep.KERNEL32(00000064,?,003D457C,?,0041A500), ref: 003E5514
Part of subcall function 003E545D: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,003D457C,?,0041A500), ref: 003E5537
Part of subcall function 003E545D: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,003D457C,?,0041A500), ref: 003E5552
Part of subcall function 003E545D: WriteFile.KERNEL32(?,|E=,0041A500,00000000,00000000,?,003D457C,?,0041A500), ref: 003E556D
Part of subcall function 003E545D: WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,003D457C,?,0041A500), ref: 003E5588

Part of subcall function 004102EC: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,003D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 004102F8
Part of subcall function 004102EC: GetLastError.KERNEL32(?,003D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00410306

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,003FC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 003FCB1F
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,003FC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 003FCB2E
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,003FC8CF,?,?,?,?,?,00000000,?,?,?), ref: 003FCB45

Strings

burn.embedded, xrefs: 003FCA16
Failed to process messages from embedded message., xrefs: 003FCAE2
Failed to wait for embedded executable: %ls, xrefs: 003FCB02
Failed to allocate embedded command., xrefs: 003FCA32
Failed to create embedded pipe., xrefs: 003FCA05
c:\agent\_work\66\s\src\burn\engine\embedded.cpp, xrefs: 003FCA84
%ls -%ls %ls %ls %u, xrefs: 003FCA1E
Failed to create embedded pipe name and client token., xrefs: 003FC9DE
Failed to wait for embedded process to connect to pipe., xrefs: 003FCABD
Failed to create embedded process at path: %ls, xrefs: 003FCA91

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$c:\agent\_work\66\s\src\burn\engine\embedded.cpp
API String ID: 875070380-1877421928
Opcode ID: a9cd579f5da7ae82340afefe22357c0721f6edc747ee9de18bd0a2dc8ecda3c6
Instruction ID: e57c79f71bf3335cd9b81bc7166b833649af86ecdade651718debac9680b9b10
Opcode Fuzzy Hash: a9cd579f5da7ae82340afefe22357c0721f6edc747ee9de18bd0a2dc8ecda3c6
Instruction Fuzzy Hash: 1C516F72D9022DBBDF12DB94DD02FEEBAB8AB04710F110126FA00B6290D775AE448B95

Function 003DEC76 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 003DEE04

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

SysFreeString.OLEAUT32(?), ref: 003DEDBC

Strings

Filename, xrefs: 003DED37
Failed to get @Filename., xrefs: 003DEE5F
Failed to get @Regid., xrefs: 003DEE55
Failed to get SoftwareTag text., xrefs: 003DEE41
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 003DECF9
Failed to convert SoftwareTag text to UTF-8, xrefs: 003DEE37
Failed to get software tag count., xrefs: 003DECCB
Failed to get next node., xrefs: 003DEE69
Failed to get @Path., xrefs: 003DEE4B
Failed to allocate memory for software tag structs., xrefs: 003DED03
Regid, xrefs: 003DED52
SoftwareTag, xrefs: 003DEC85
Path, xrefs: 003DED6A
`<u, xrefs: 003DEDBC, 003DEE04
Failed to select software tag nodes., xrefs: 003DECA6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`<u$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 336948655-2390364300
Opcode ID: 610edd70661162e239eaa3e291f12c7c990571ce0358898a6b9188f17d76c6db
Instruction ID: b14f1919dbdf9c6baa8ba6f060e50dd5ed4dea17bfc91bbfa9b90b5b06a677ef
Opcode Fuzzy Hash: 610edd70661162e239eaa3e291f12c7c990571ce0358898a6b9188f17d76c6db
Instruction Fuzzy Hash: 3D51A372A00229EFCB16EF55E891EAEBBB9AF04714F21416BF811AF341C674DD408754

Function 00417741 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00417C2B,00000001,?), ref: 00417761
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00417C2B,00000001,?), ref: 0041777C
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00417C2B,00000001,?), ref: 00417797
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00417C2B,00000001,?), ref: 00417803
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00417C2B,00000001,?), ref: 00417827
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00417C2B,00000001,?), ref: 0041784B
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00417C2B,00000001,?), ref: 0041786B
lstrlenW.KERNEL32(006C0064,?,00417C2B,00000001,?), ref: 00417886

Strings

sha256, xrefs: 00417862
md5, xrefs: 0041781E
http://appsyndication.org/2006/appsyn, xrefs: 00417754
digest, xrefs: 00417773
msi.dll, xrefs: 0041775B
name, xrefs: 0041778E
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 0041789E
algorithm, xrefs: 004177FA
sha1, xrefs: 00417842

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-124732866
Opcode ID: e42dc84772af7fcb80c6db09e387e0602bcd62e87f3b8fdf57ba4f720313dd0f
Instruction ID: 83796af269c36c95dd9b92b7687fd9ae463192374aa7a05f80885183e40ee7bb
Opcode Fuzzy Hash: e42dc84772af7fcb80c6db09e387e0602bcd62e87f3b8fdf57ba4f720313dd0f
Instruction Fuzzy Hash: 5051D73168C612BBDB205F548C86F927A71AF15730F308316FA35AE2D5C768EC90C799

Function 003D9FFE Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 214COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003DA076

Strings

State, xrefs: 003DA058
Failed to format GUID string., xrefs: 003DA081
Trying per-user extended info for property '%ls' for product: %ls, xrefs: 003DA135
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 003DA108
Product or related product not found: %ls, xrefs: 003DA161
Failed to copy upgrade code., xrefs: 003DA0D6
AssignmentType, xrefs: 003DA051
Failed to set variable., xrefs: 003DA1FC
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 003DA20F
Unsupported product search type: %u, xrefs: 003DA03E
Language, xrefs: 003DA05F
Failed to enumerate related products for upgrade code., xrefs: 003DA0B1
Failed to get product info., xrefs: 003DA1A3
VersionString, xrefs: 003DA066, 003DA0F1, 003DA107, 003DA11B, 003DA134, 003DA148
Failed to change value type., xrefs: 003DA1DD

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 959f3fee602f90f3859959026a343f9095de18efd7cda83a46d57bf3e209c545
Instruction ID: 057c4abd8a04868811a95aea83d093142de4edd717a8c6c1c6bffae8914f0fd6
Opcode Fuzzy Hash: 959f3fee602f90f3859959026a343f9095de18efd7cda83a46d57bf3e209c545
Instruction Fuzzy Hash: 52610673D40918BBCB239A99EA46EEE7B78AB04704F214167F500BB381D236DF409796

Function 003E4AB0 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 157sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 003E4B0A
GetLastError.KERNEL32 ref: 003E4B18
Sleep.KERNEL32(00000064), ref: 003E4B3C

Strings

Failed to open parent pipe: %ls, xrefs: 003E4B62
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E4B55, 003E4C58
Failed to allocate name of parent cache pipe., xrefs: 003E4BB1
\\.\pipe\%ls.Cache, xrefs: 003E4B9D
\\.\pipe\%ls, xrefs: 003E4AC2
Failed to verify parent pipe: %ls, xrefs: 003E4B84
feclient.dll, xrefs: 003E4B6F, 003E4C0A, 003E4C1E, 003E4C62
Failed to open companion process with PID: %u, xrefs: 003E4C64
Failed to allocate name of parent pipe., xrefs: 003E4AD6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$feclient.dll
API String ID: 408151869-2029237024
Opcode ID: 19c7a35fd7785d0979c6230bde68676390e3367739d1161238244f8151d546f0
Instruction ID: d1a9bb7335ead6984e1089b1fd65bda6b8e5eb8af6b1dfc37011d4e3771dd20e
Opcode Fuzzy Hash: 19c7a35fd7785d0979c6230bde68676390e3367739d1161238244f8151d546f0
Instruction Fuzzy Hash: 50414D72D41232BBC7235BA19D06F5A79685F08721F224322FD00BB2C0D77DDE1096D9

Function 003DF52B Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,003E0478,InstallerVersion,InstallerVersion,00000000,003E0478,InstallerName,InstallerName,00000000,003E0478,Date,InstalledDate,00000000,003E0478,LogonUser), ref: 003DF6D9

Part of subcall function 00410D87: RegSetValueExW.ADVAPI32(00020006,0041FF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,003DF2DF,00000000,?,00020006), ref: 00410DBA

Strings

PackageName, xrefs: 003DF5A5, 003DF5B8
LogonUser, xrefs: 003DF64F
Failed to write %ls value., xrefs: 003DF6C2
ReleaseType, xrefs: 003DF630, 003DF635, 003DF644
Failed to create the key for update registration., xrefs: 003DF579
InstalledBy, xrefs: 003DF64A, 003DF663
Publisher, xrefs: 003DF5E5, 003DF5F8
InstalledDate, xrefs: 003DF66A, 003DF683
ThisVersionInstalled, xrefs: 003DF585, 003DF598
Failed to get the formatted key path for update registration., xrefs: 003DF54D
InstallerVersion, xrefs: 003DF6A7, 003DF6AC, 003DF6AD, 003DF6BD
Date, xrefs: 003DF66F
PublishingGroup, xrefs: 003DF60D, 003DF620
PackageVersion, xrefs: 003DF5C5, 003DF5D8
InstallerName, xrefs: 003DF68A, 003DF68F, 003DF690, 003DF6A0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: 76909e318c089ae58652740601d0c38b2c6b3d2d5119917264c133c0b1c817aa
Instruction ID: ca8e05bd1b704367377aee301203e97b08c0b4ff55ddb23e4e7125395cf0f633
Opcode Fuzzy Hash: 76909e318c089ae58652740601d0c38b2c6b3d2d5119917264c133c0b1c817aa
Instruction Fuzzy Hash: 3541B633B40635BBDB136A50BC42FAE7925AB10B54F650177FC02B6B71C764DE509288

Function 003EE60C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 003EE652
RegisterClassW.USER32(?), ref: 003EE67E
GetLastError.KERNEL32 ref: 003EE689
CreateWindowExW.USER32(00000080,004291B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 003EE6F0
GetLastError.KERNEL32 ref: 003EE6FA
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 003EE798

Strings

c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 003EE6AD, 003EE71E
Unexpected return value from message pump., xrefs: 003EE783
Failed to create window., xrefs: 003EE728
WixBurnMessageWindow, xrefs: 003EE677, 003EE793
Failed to register window., xrefs: 003EE6B7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 213125376-1202977178
Opcode ID: 8e33cf6e597184505cbce8ab93a3666c6a8ae57de392ec7bf3486a6fbde27076
Instruction ID: 82655998060622539794cb46bd6b9df1ec343e7d7eb19f774189bdab87c89f53
Opcode Fuzzy Hash: 8e33cf6e597184505cbce8ab93a3666c6a8ae57de392ec7bf3486a6fbde27076
Instruction Fuzzy Hash: 0041C676A01239ABDB118F91DC48BDEBFB8EF04750F118266FD04BA180D7359D10CBA5

Function 003FC45E Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to allocate space for burn payload inside of related bundle struct, xrefs: 003FC6D1
Failed to copy download source for passthrough pseudo bundle., xrefs: 003FC679
Failed to copy cache id for passthrough pseudo bundle., xrefs: 003FC6EF
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 003FC492, 003FC68B, 003FC6C5
Failed to copy key for passthrough pseudo bundle., xrefs: 003FC672
Failed to copy related arguments for passthrough bundle package, xrefs: 003FC76C
Failed to allocate memory for pseudo bundle payload hash., xrefs: 003FC697
Failed to copy filename for passthrough pseudo bundle., xrefs: 003FC6A8
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 003FC796
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 003FC49E
Failed to copy local source path for passthrough pseudo bundle., xrefs: 003FC6A1
Failed to copy install arguments for passthrough bundle package, xrefs: 003FC74C
Failed to recreate command-line arguments., xrefs: 003FC72D
Failed to copy key for passthrough pseudo bundle payload., xrefs: 003FC6AF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1911474293
Opcode ID: fc0c6b91002a1d29d0582bef680e9d4291fc116293170cd3095880a8f67e5e2e
Instruction ID: b8b17c0669700d63f5b0dab6c1ba1abbc77cbc277253e9221e45252bae95874a
Opcode Fuzzy Hash: fc0c6b91002a1d29d0582bef680e9d4291fc116293170cd3095880a8f67e5e2e
Instruction Fuzzy Hash: 05B1AC71A50619EFCB22DF28C981F66BBA5BF08310F555166FE14AF361C735E810DB80

Function 003FDAF8 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,00000000,00000000,?), ref: 003FDB13

Strings

Invalid BITS engine URL: %ls, xrefs: 003FDB35
Failed to create BITS job., xrefs: 003FDBA2
Failed to download BITS job., xrefs: 003FDCAA
Falied to start BITS job., xrefs: 003FDCCB
Failed to create BITS job callback., xrefs: 003FDC26
Failed to initialize BITS job callback., xrefs: 003FDC34
Failed to copy download URL., xrefs: 003FDB5A
Failed to complete BITS job., xrefs: 003FDCBD
Failed to set credentials for BITS job., xrefs: 003FDBC1
c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 003FDB29, 003FDC1C
Failed to set callback interface for BITS job., xrefs: 003FDC4B
Failed while waiting for BITS download., xrefs: 003FDCC4
Failed to add file to BITS job., xrefs: 003FDBE0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 1659193697-397540975
Opcode ID: a59b271778d83e71a7b49c9b49f7dcccb91a95d90f3932090402cbfffb376197
Instruction ID: d024e310727b6a2607d793b4a273bbeb382d48d8723fa45c6db5e38027a14340
Opcode Fuzzy Hash: a59b271778d83e71a7b49c9b49f7dcccb91a95d90f3932090402cbfffb376197
Instruction Fuzzy Hash: 6251A531A00229EBCB139B54D989E7E7BBAAF19710F224156FE04AB251D7B4DD00EB94

Function 003DBC5E Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003DBCB0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 003DBDBD
GetLastError.KERNEL32(?,?,?,?), ref: 003DBDC7
WaitForInputIdle.USER32(?,?), ref: 003DBE1B
CloseHandle.KERNEL32(?,?,?), ref: 003DBE66
CloseHandle.KERNEL32(?,?,?), ref: 003DBE73

Strings

"%ls", xrefs: 003DBD2D, 003DBD47
"%ls" %s, xrefs: 003DBCD6, 003DBD17
c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp, xrefs: 003DBDEB
D, xrefs: 003DBD9C
Failed to create obfuscated executable command., xrefs: 003DBD5B
Failed to create executable command., xrefs: 003DBCEA
Failed to format argument string., xrefs: 003DBCBB
Failed to format obfuscated argument string., xrefs: 003DBD07
Failed to CreateProcess on path: %ls, xrefs: 003DBDF8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp
API String ID: 155678114-3058035682
Opcode ID: 363577c2fcda2c43a92553c992409f3a7a63d45d8dbbf3be83715dca6de11a5d
Instruction ID: 65aa9da4be601d49f28ab7faaa49a2078f9312e06b4f4503fc82fd4ad85e7928
Opcode Fuzzy Hash: 363577c2fcda2c43a92553c992409f3a7a63d45d8dbbf3be83715dca6de11a5d
Instruction Fuzzy Hash: 1E514973D0021AFBDF129FE1EC41AEEFB79BF14700B164566EA04B6220E7359E509B91

Function 003F673A Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,003F6C89,?), ref: 003F6773
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,003F6C89,?,?,?), ref: 003F6780
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,003F6C89,?,?,?), ref: 003F67C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,003F6C89,?,?,?), ref: 003F67D4
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,003F6C89,?,?,?), ref: 003F680E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,003F6C89,?,?,?), ref: 003F6818
CloseServiceHandle.ADVAPI32(00000000), ref: 003F68CF
CloseServiceHandle.ADVAPI32(?), ref: 003F68D9

Strings

Failed to open WU service., xrefs: 003F6802
Failed to mark WU service to start on demand., xrefs: 003F68A0
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 003F67A4, 003F67F8, 003F683C
wuauserv, xrefs: 003F67C2
Failed to query status of WU service., xrefs: 003F6846
Failed to open service control manager., xrefs: 003F67AE
Failed to read configuration for WU service., xrefs: 003F687F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wuauserv
API String ID: 971853308-110228879
Opcode ID: 5d0a68599f2468f32971d5a44f298fd8a9add498ece4100ba1432d3836239459
Instruction ID: 0382d3e491a16956a9c3df6d847f77868663fa62b367d558210b7f8d5175cc58
Opcode Fuzzy Hash: 5d0a68599f2468f32971d5a44f298fd8a9add498ece4100ba1432d3836239459
Instruction Fuzzy Hash: 9741C936F413396BD712DBA49D86BBEB6E4AF04754B124139FE01BB241D678DC0486A4

Function 003DB1D7 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,003DBACA,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB1DF
GetLastError.KERNEL32(?,003DBACA,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 003DB1EB
_memcmp.LIBVCRUNTIME ref: 003DB293

Strings

burn, xrefs: 003DB2BA
Failed to find Burn section., xrefs: 003DB301
Failed to get module handle to process., xrefs: 003DB219
Failed to read section info, unsupported version: %08x, xrefs: 003DB32D
Failed to find valid DOS image header in buffer., xrefs: 003DB24C
.wixburn, xrefs: 003DB28D
Failed to read section info, data to short: %u, xrefs: 003DB2E3
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 003DB36A
Failed to find valid NT image header in buffer., xrefs: 003DB277
.wix, xrefs: 003DB2B2
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 003DB20F, 003DB240, 003DB26B, 003DB2D4, 003DB2F5, 003DB31E, 003DB35E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3888311042-3868660166
Opcode ID: 8ebd68992f437c8b63d3bd8db485238bb60ff58922db787af560cdc048f538a0
Instruction ID: ce75ee266a2aeb8da439564d1bd394c7a6a48fb57ae5a79b7a7a82b3ceb21967
Opcode Fuzzy Hash: 8ebd68992f437c8b63d3bd8db485238bb60ff58922db787af560cdc048f538a0
Instruction Fuzzy Hash: 0E418A37680210E7D7235951BC42FAAA255AF81B21B37402BFD026F381D7BDCD46D2AE

Function 003DA249 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003DA271
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,?,00000001,00000000,00000000,?,00000000,?,000002C0,000002C0,?,00000000,00000000), ref: 003DA3C5

Strings

Failed to format key string., xrefs: 003DA27C
Failed to query registry key value., xrefs: 003DA353
Registry key not found. Key = '%ls', xrefs: 003DA2B2
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 003DA360
Failed to open registry key. Key = '%ls', xrefs: 003DA2C6
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 003DA349
Failed to set variable., xrefs: 003DA388
Failed to format value string., xrefs: 003DA2FD
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 003DA39D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseOpen@16
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1561904661-635686934
Opcode ID: 6a064114fc4c58fd54e5a3b92d7073df00919e89aa75dee27052eb9fca98c079
Instruction ID: c9b87a81dc6161bf28cf8548b626e89b0203387e861b367b37af2824a28fc46d
Opcode Fuzzy Hash: 6a064114fc4c58fd54e5a3b92d7073df00919e89aa75dee27052eb9fca98c079
Instruction Fuzzy Hash: 3541D377D00524BBCB139FA5ED02FEE7B6AAF04710F214167FC00B6292D6759E10AA95

Function 003D695F Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 003D69AF
GetLastError.KERNEL32 ref: 003D69B9
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 003D69FC
GetLastError.KERNEL32 ref: 003D6A06
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 003D6B17

Strings

Failed to get OS info., xrefs: 003D6A57
ntdll, xrefs: 003D69A9
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D69DD, 003D6A2A
Failed to locate NTDLL., xrefs: 003D69E7
Failed to locate RtlGetVersion., xrefs: 003D6A34
Failed to set variant value., xrefs: 003D6AFB
RtlGetVersion, xrefs: 003D69F1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$c:\agent\_work\66\s\src\burn\engine\variable.cpp$ntdll
API String ID: 3057421322-3993976954
Opcode ID: 8071dc1912fb4f6f602189b51bf3ccbea4fbb252a5d697dbb3a96994f02032a3
Instruction ID: 2fdc35e24e89bcaf0869ebfe50314cf1522a8e4ec24b1d2e2e3f8b5ff1c314a7
Opcode Fuzzy Hash: 8071dc1912fb4f6f602189b51bf3ccbea4fbb252a5d697dbb3a96994f02032a3
Instruction Fuzzy Hash: 97412773D412386BCB229B659C06BEE7AB4AF08710F0141ABF954F6281D778CE94CF94

Function 003D4936 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,003D54A3,?,?,?,?), ref: 003D4967
GetLastError.KERNEL32(?,?,?,003D54A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003D4978
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 003D4AB5
CloseHandle.KERNEL32(?,?,?,?,003D54A3,?,?,?,?,?,?,?,?,?,?,?), ref: 003D4ABE

Strings

comres.dll, xrefs: 003D4A24
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 003D499C, 003D49E5
Failed to connect to unelevated process., xrefs: 003D495D
Failed to pump messages from parent process., xrefs: 003D4A89
Failed to create the message window., xrefs: 003D4A13
Failed to allocate thread local storage for logging., xrefs: 003D49A6
Failed to set elevated pipe into thread local storage for logging., xrefs: 003D49EF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$comres.dll
API String ID: 687263955-55126310
Opcode ID: 44a0eec19a4672de085bfeed531f0e79797f8de8954eff80367ebf757a19a4c4
Instruction ID: f288e45cc642fbaab252a8fb4a941035bb54055546dd0e6904ac4dffe8e4f4a6
Opcode Fuzzy Hash: 44a0eec19a4672de085bfeed531f0e79797f8de8954eff80367ebf757a19a4c4
Instruction Fuzzy Hash: 3041D573A41626BBC7139BA19C45EEBBA6CBF04710F110337FA05E6240DB34AD6097E9

Function 003E3AD7 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 129COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 003E3B2B
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 003E3B35
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 003E3B9E
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 003E3BA5
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 003E3C2F

Strings

Failed to get length of temp folder., xrefs: 003E3B8F
crypt32.dll, xrefs: 003E3AEA
Failed to get length of session id string., xrefs: 003E3BFA
Failed to copy temp folder., xrefs: 003E3C58
%u\, xrefs: 003E3BBF
Failed to get temp folder., xrefs: 003E3B63
Failed to format session id as a string., xrefs: 003E3BD3
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 003E3B59

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$c:\agent\_work\66\s\src\burn\engine\logging.cpp$crypt32.dll
API String ID: 2407829081-4120445549
Opcode ID: fe62be8828e2c212517011ecebe95592f19dacdb24b82ecc617ce107889d39e7
Instruction ID: f3e471dd1697a5e8709d90f0ddf631f609ffb833865072407443a5e014163b56
Opcode Fuzzy Hash: fe62be8828e2c212517011ecebe95592f19dacdb24b82ecc617ce107889d39e7
Instruction Fuzzy Hash: E441C772D8127DABCB229B619C4DFDA7778AF14710F2102E2F909B7281D6749F848B94

Function 003D7FA2 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 003D7FBF
LeaveCriticalSection.KERNEL32(?), ref: 003D81E7

Strings

Failed to write variable count., xrefs: 003D7FDA
Failed to write included flag., xrefs: 003D81D5
Failed to get version., xrefs: 003D8198
Failed to write variable value as string., xrefs: 003D81AB
Failed to get numeric., xrefs: 003D81B9
Failed to write variable value type., xrefs: 003D81C7
Failed to write literal flag., xrefs: 003D81C0
Failed to write variable name., xrefs: 003D81CE
Failed to write variable value as number., xrefs: 003D8191
feclient.dll, xrefs: 003D809A, 003D80F0, 003D8131
Unsupported variable type., xrefs: 003D81A4
Failed to get string., xrefs: 003D81B2

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: a677c81d79d5d2e7b5b6adcb5d8c36ebba2502af61686893401f5cedeedb792e
Instruction ID: 5d246a326b2fb7a535d0433c6798b7fe62daf1c08b9dd841d6c6788d7ae3ca8d
Opcode Fuzzy Hash: a677c81d79d5d2e7b5b6adcb5d8c36ebba2502af61686893401f5cedeedb792e
Instruction Fuzzy Hash: 2C71AE33940219EBCB139FA4ED41BAE7BA8BF04314F114127F901A7791DB34ED5A9B90

Function 003E9692 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,003EA724,?,00000000,00000000,00000000,?), ref: 003E96AD
GetLastError.KERNEL32(?,003EA724,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003E96BD

Part of subcall function 00413933: Sleep.KERNEL32(?,00000000,?,003E84D1,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,003D4DFD), ref: 0041394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 003E97C9

Strings

Failed to verify payload hash: %ls, xrefs: 003E9755
Failed to verify payload signature: %ls, xrefs: 003E9718
Copying, xrefs: 003E9768, 003E9773
Failed to move %ls to %ls, xrefs: 003E97A1
Moving, xrefs: 003E975F
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E96E1
Failed to open payload in working path: %ls, xrefs: 003E96EC
Failed to copy %ls to %ls, xrefs: 003E97B7
%ls payload from working path '%ls' to path '%ls', xrefs: 003E9774

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-540362316
Opcode ID: 38a2b3e05f3b827e7d0e1cbd5a6b6ff682e3cbe198c915517488f36afec7f0ac
Instruction ID: 671539b8b6dbecf3260a79051b8f6d80889672ea8b05d587b94775ce5d87e3c5
Opcode Fuzzy Hash: 38a2b3e05f3b827e7d0e1cbd5a6b6ff682e3cbe198c915517488f36afec7f0ac
Instruction Fuzzy Hash: 85310672A516B07BDB332E179C46F6B2A1C9F45F61F02032BBD007B2C2D2659C0487E9

Function 003D65DC Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 003D6618

Part of subcall function 0041038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,003D5EE0,00000000), ref: 0041039E
Part of subcall function 0041038A: GetProcAddress.KERNEL32(00000000), ref: 004103A5
Part of subcall function 0041038A: GetLastError.KERNEL32(?,?,?,003D5EE0,00000000), ref: 004103BC

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 003D6644
GetLastError.KERNEL32 ref: 003D6652
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 003D668A
GetLastError.KERNEL32 ref: 003D6694
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 003D66D7
GetLastError.KERNEL32 ref: 003D66E1

Strings

Failed to get 32-bit system folder., xrefs: 003D66C2
Failed to backslash terminate system folder., xrefs: 003D6724
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D6676, 003D66B8
Failed to get 64-bit system folder., xrefs: 003D6680
Failed to set system folder variant value., xrefs: 003D6740

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 325818893-3341528362
Opcode ID: f8428bfc85d253e76b7bdab27edeb4bc8d3a9d201b0ffdba4bfdd9726cb6831f
Instruction ID: 59582c8d645a2cba433aeb8b2419a148d09b0d2bf1bf8dfea6d33b8d7d129412
Opcode Fuzzy Hash: f8428bfc85d253e76b7bdab27edeb4bc8d3a9d201b0ffdba4bfdd9726cb6831f
Instruction Fuzzy Hash: F4315873D41239A7D7239B64AC4EBDA3668AF00714F124167FD20BB381E678DD808AE5

Function 003E3F22 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 003E3A2C: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,003E3F3C,feclient.dll,?,00000000,?,?,?,003D4B57), ref: 003E3ACD

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,003D4B57,?,?,0041A488,?,00000001,00000000,00000000), ref: 003E3FD3

Strings

Setup, xrefs: 003E3F80
clbcatq.dll, xrefs: 003E4112
crypt32.dll, xrefs: 003E3F79, 003E3FDE, 003E3FE6, 003E4049, 003E408B, 003E40CE, 003E40ED, 003E412B, 003E4155
Failed to copy log path to prefix., xrefs: 003E40FB
Failed to open log: %ls, xrefs: 003E404B
Failed to copy log extension to extension., xrefs: 003E411E
Failed to get non-session specific TEMP folder., xrefs: 003E4081
Failed to get current directory., xrefs: 003E3FB5
msasn1.dll, xrefs: 003E40EF, 003E4130
feclient.dll, xrefs: 003E3F36, 003E3FE3
log, xrefs: 003E3F7A
Failed to copy full log path to prefix., xrefs: 003E413C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: ebf1d5ed88368a385d281757850ff296789dfc6fb080af3b796f0b31fe24c6fb
Instruction ID: b332bda0bef21b7a7bd40b3a585f8b9ae0f6a4af2b630a2130b9217c5d2ba11c
Opcode Fuzzy Hash: ebf1d5ed88368a385d281757850ff296789dfc6fb080af3b796f0b31fe24c6fb
Instruction Fuzzy Hash: B261D371A002B6BADF279B26C845B6AB7A8EF14340B154776F801DB6C0E7B4ED508691

Function 003D6DCB Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,003D53FA,00000000,003D5482,00000000,?,003D82B1,?,?,?,00000000,00000000), ref: 003D6DDA

Part of subcall function 003D56E2: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,003D65B1,003D65B1,?,003D5678,?,?,00000000), ref: 003D571E
Part of subcall function 003D56E2: GetLastError.KERNEL32(?,003D5678,?,?,00000000,?,?,003D65B1,?,003D7F03,?,?,?,?,?), ref: 003D574D

LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,00000000,00000000), ref: 003D6F6A

Strings

Failed to find variable value '%ls'., xrefs: 003D6DF5
Setting hidden variable '%ls', xrefs: 003D6E98
Failed to set value of variable: %ls, xrefs: 003D6F52
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D6E5D
Attempt to set built-in variable value: %ls, xrefs: 003D6E68
Failed to insert variable '%ls'., xrefs: 003D6E1F
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 003D6F7C
Setting string variable '%ls' to value '%ls', xrefs: 003D6EFA, 003D6F02
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 003D6EDF
Unsetting variable '%ls', xrefs: 003D6EF3, 003D6F26
Setting numeric variable '%ls' to value %lld, xrefs: 003D6F0B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2716280545-3393465121
Opcode ID: 33c2b9a3d7432704d7c0d66ba155cab33a2a2a54a91e721c6ea6037ebf3b38e5
Instruction ID: 04b79464ffac83f662fe7e071771a8b3f72c138726ee3a5489f7041c4353caa9
Opcode Fuzzy Hash: 33c2b9a3d7432704d7c0d66ba155cab33a2a2a54a91e721c6ea6037ebf3b38e5
Instruction Fuzzy Hash: 81510A72A40111ABCB329F15ED9BFAB376CEB95704F25012BF8605A382C379DD51CAE0

Function 00408C92 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00408CD6

Part of subcall function 0040880C: _free.LIBCMT ref: 00408829
Part of subcall function 0040880C: _free.LIBCMT ref: 0040883B
Part of subcall function 0040880C: _free.LIBCMT ref: 0040884D
Part of subcall function 0040880C: _free.LIBCMT ref: 0040885F
Part of subcall function 0040880C: _free.LIBCMT ref: 00408871
Part of subcall function 0040880C: _free.LIBCMT ref: 00408883
Part of subcall function 0040880C: _free.LIBCMT ref: 00408895
Part of subcall function 0040880C: _free.LIBCMT ref: 004088A7
Part of subcall function 0040880C: _free.LIBCMT ref: 004088B9
Part of subcall function 0040880C: _free.LIBCMT ref: 004088CB
Part of subcall function 0040880C: _free.LIBCMT ref: 004088DD
Part of subcall function 0040880C: _free.LIBCMT ref: 004088EF
Part of subcall function 0040880C: _free.LIBCMT ref: 00408901

_free.LIBCMT ref: 00408CCB

Part of subcall function 00405CE8: HeapFree.KERNEL32(00000000,00000000,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?), ref: 00405CFE
Part of subcall function 00405CE8: GetLastError.KERNEL32(?,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?,?), ref: 00405D10

_free.LIBCMT ref: 00408CED
_free.LIBCMT ref: 00408D02
_free.LIBCMT ref: 00408D0D
_free.LIBCMT ref: 00408D2F
_free.LIBCMT ref: 00408D42
_free.LIBCMT ref: 00408D50
_free.LIBCMT ref: 00408D5B
_free.LIBCMT ref: 00408D93
_free.LIBCMT ref: 00408D9A
_free.LIBCMT ref: 00408DB7
_free.LIBCMT ref: 00408DCF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1ef778a463e9588c05571bc92435bf13634bba59b07d67b636d0b5e8c49d5dce
Instruction ID: a50b22e92c7832a571b326507d859ea68c7d8a4a930668ac793040b7493c919e
Opcode Fuzzy Hash: 1ef778a463e9588c05571bc92435bf13634bba59b07d67b636d0b5e8c49d5dce
Instruction Fuzzy Hash: 013138316047049FEB20AA7ADA45B5B73E9FF50314F20453FE489E62D1DF38A890CB28

Function 003E2C15 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,00007070,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 003E2C83

Strings

wininet.dll, xrefs: 003E2ED0
Failed to add self-dependent to ignore dependents., xrefs: 003E2D07
crypt32.dll, xrefs: 003E2CCE, 003E2DC8, 003E2EBD, 003E2F32
Failed to allocate registration action., xrefs: 003E2CEC
Failed to add dependents ignored from command-line., xrefs: 003E2D38
Failed to create the string dictionary., xrefs: 003E2CBC
Failed to add dependent bundle provider key to ignore dependents., xrefs: 003E2DED
Failed to add registration action for dependent related bundle., xrefs: 003E2F85
Failed to add registration action for self dependent., xrefs: 003E2F50
Failed to check for remaining dependents during planning., xrefs: 003E2E29

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: c465bae5a659a70ec50eb4b8030a471db380557b8d59fad895529d0d285a8f76
Instruction ID: 275db69a13c4ddb11b2fad62d790d7ddf18078b4f1818cdf82edf38f806929e2
Opcode Fuzzy Hash: c465bae5a659a70ec50eb4b8030a471db380557b8d59fad895529d0d285a8f76
Instruction Fuzzy Hash: 41B18E70A0027AEFCF269F56CC41AAF7BB9BF44300F11426AF915AA291D770DD51CB91

Function 003EF748 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003EF784
UuidCreate.RPCRT4(?), ref: 003EF867
StringFromGUID2.OLE32(?,?,00000027), ref: 003EF888
LeaveCriticalSection.KERNEL32(?,?), ref: 003EF931

Strings

Failed to default local update source, xrefs: 003EF7F4
update\%ls, xrefs: 003EF7E0
Failed to convert bundle update guid into string., xrefs: 003EF8A7
Failed to recreate command-line for update bundle., xrefs: 003EF84F
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EF89D
Failed to create bundle update guid., xrefs: 003EF874
Failed to set update bundle., xrefs: 003EF90B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp$update\%ls
API String ID: 171215650-494903540
Opcode ID: 86b5f9c7a48be9b97519a9564fcaec83a29fa36d2ba6779d66c596fcfb16ed9f
Instruction ID: 03700cbf176649096f310e08482da444f15c02c9f36a4ad67f0bc4e15ae41095
Opcode Fuzzy Hash: 86b5f9c7a48be9b97519a9564fcaec83a29fa36d2ba6779d66c596fcfb16ed9f
Instruction Fuzzy Hash: F351A131A40265AFDF229FA5D845FAE7BB5EF08750F11427AF909AB292D7709C40CB50

Function 003D4B2A Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 003D4CA9
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003D4CBA

Strings

WixBundleLayoutDirectory, xrefs: 003D4C3A
Failed while running , xrefs: 003D4C6F
Failed to create the message window., xrefs: 003D4BDD
Failed to open log., xrefs: 003D4B5D
Failed to set layout directory variable to value provided from command-line., xrefs: 003D4C4B
Failed to set registration variables., xrefs: 003D4C23
Failed to query registration., xrefs: 003D4BF3
Failed to check global conditions, xrefs: 003D4B8E
Failed to set action variables., xrefs: 003D4C09

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: 12670684d354b398d083dd701c6d65a7bc1b916c14a30e6ed54d3b805d0c60a1
Instruction ID: 3958cef7f28a7bc2456f7a8682bf84f85c9995d888dc97e50d74cf542c318e1a
Opcode Fuzzy Hash: 12670684d354b398d083dd701c6d65a7bc1b916c14a30e6ed54d3b805d0c60a1
Instruction Fuzzy Hash: 5B411673A42A26BBCB275A20ED45FAAB66CBF00750F114327B804A7790DB70ED6487D5

Function 003EEE9A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 003EEEB7
LeaveCriticalSection.KERNEL32(?), ref: 003EEFE4

Strings

Engine is active, cannot change engine state., xrefs: 003EEED2
Failed to copy the id., xrefs: 003EEF49
UX requested unknown approved exe with id: %ls, xrefs: 003EEF17
Failed to copy the arguments., xrefs: 003EEF76
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EEFC5
Failed to post launch approved exe message., xrefs: 003EEFCF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 1367039788-2920183924
Opcode ID: c6f05991af0fbc408d27271961ed377c4eed11a04e7d487c6394062c516fb4c8
Instruction ID: a381351cc8b617302a1c78c43abab958c0e44f1437d222345eec7f4b6c8d412b
Opcode Fuzzy Hash: c6f05991af0fbc408d27271961ed377c4eed11a04e7d487c6394062c516fb4c8
Instruction Fuzzy Hash: 7831F632650275AFD7239F65EC05E5A77A8AF01720B168226FC04EF391E774ED0087A4

Function 003E957D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,003EA6B7,?,00000000,00000000,00000000,?), ref: 003E9598
GetLastError.KERNEL32(?,003EA6B7,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003E95A6

Part of subcall function 00413933: Sleep.KERNEL32(?,00000000,?,003E84D1,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,003D4DFD), ref: 0041394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 003E9684

Strings

Failed to verify container hash: %ls, xrefs: 003E9607
Copying, xrefs: 003E9623, 003E962E
Failed to move %ls to %ls, xrefs: 003E965C
Moving, xrefs: 003E961A
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E95CA
%ls container from working path '%ls' to path '%ls', xrefs: 003E962F
Failed to copy %ls to %ls, xrefs: 003E9672
Failed to open container in working path: %ls, xrefs: 003E95D5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-3604842143
Opcode ID: b6501f95141bfa04c2d32ed87d237a84fa988f64c28c50bd6bd9b04f639539ba
Instruction ID: 95a97c13a87a10fbb2b685268b27385210679fd6db0c96e6f50ee0f6c30dc7a4
Opcode Fuzzy Hash: b6501f95141bfa04c2d32ed87d237a84fa988f64c28c50bd6bd9b04f639539ba
Instruction Fuzzy Hash: 9D210972B412707BD7331A16AC06FEB252C9F41B25F520227FD007A2C2D2A99D5087ED

Function 003E4177 Relevance: 19.3, APIs: 4, Strings: 7, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 0040FDEF: EnterCriticalSection.KERNEL32(0043B5D4,00000000,?,?,?,003E4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,003D5537,?), ref: 0040FDFF
Part of subcall function 0040FDEF: LeaveCriticalSection.KERNEL32(0043B5D4,?,?,0043B5CC,?,003E4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,003D5537,?), ref: 0040FF46

OpenEventLogW.ADVAPI32(00000000,Application), ref: 003E419D
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 003E41A9
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,H,B,00000000), ref: 003E41F6
CloseEventLog.ADVAPI32(00000000), ref: 003E41FD

Strings

Setup, xrefs: 003E4187
txt, xrefs: 003E417D
Failed to open Application event log, xrefs: 003E41D7
_Failed, xrefs: 003E4182
Application, xrefs: 003E4197
H,B, xrefs: 003E41E7
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 003E41CD

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$H,B$Setup$_Failed$c:\agent\_work\66\s\src\burn\engine\logging.cpp$txt
API String ID: 1844635321-398395884
Opcode ID: 0d0d04d23ead08a111c11dbbedb157ab852e28b8d8322667478de23a2dd963e2
Instruction ID: 2d55a582070764fe804cc0544d0f8fd7907c42de07ce69ca71fa70bd20e24861
Opcode Fuzzy Hash: 0d0d04d23ead08a111c11dbbedb157ab852e28b8d8322667478de23a2dd963e2
Instruction Fuzzy Hash: BCF0D133A526713A923626237E0AFBB1D7CDACAF35352422ABD00F5180E69C4D0180B9

Function 003D6F94 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003D6FC1
LeaveCriticalSection.KERNEL32(?), ref: 003D71CD

Strings

Failed to read variable value type., xrefs: 003D71AF
Failed to read variable value as number., xrefs: 003D7187
Failed to read variable included flag., xrefs: 003D71BD
Failed to set variable value., xrefs: 003D7180
Failed to read variable value as string., xrefs: 003D719A
Failed to read variable name., xrefs: 003D71B6
Failed to set variable., xrefs: 003D71A1
Failed to read variable count., xrefs: 003D6FE1
Unsupported variable type., xrefs: 003D7193
Failed to read variable literal flag., xrefs: 003D71A8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 1d6bae6e8eea8159174b7c93edf768187e8e580dbfc6585ae3473f4466e064f5
Instruction ID: 85b9a3e56678e7c5d601ecf3182310ce219dd1522790d03810a3840f064ad518
Opcode Fuzzy Hash: 1d6bae6e8eea8159174b7c93edf768187e8e580dbfc6585ae3473f4466e064f5
Instruction Fuzzy Hash: 98719172D4411EBBCB13DEA4EC45FAEBBB9EB00710F114267F900B6290E7349E159BA0

Function 00413D01 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00413D7E
GetLastError.KERNEL32 ref: 00413D94
GetFileSizeEx.KERNEL32(00000000,?), ref: 00413DE4
GetLastError.KERNEL32 ref: 00413DEE
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 00413E42
GetLastError.KERNEL32 ref: 00413E4D
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 00413F3C
CloseHandle.KERNEL32(?), ref: 00413FAF

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00413D21, 00413DCD, 00413E0E, 00413F92

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3286166115-1688708105
Opcode ID: 8caf0ef665f5a7968f0e94b41cf0dc50ee21516c09fb0d2c0501c8ea9eb6dc22
Instruction ID: 1f4aeb30a8b08b5eb4f1a7a926bfb808b90580612a3cb3ddb5c4bc34309d7c3c
Opcode Fuzzy Hash: 8caf0ef665f5a7968f0e94b41cf0dc50ee21516c09fb0d2c0501c8ea9eb6dc22
Instruction Fuzzy Hash: 7B81E872A40316EBDB218E199C45BEB7AA8AB40721F11412BFD05EB380D77CCF81879D

Function 003D2EBC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 003D2F5C
GetLastError.KERNEL32 ref: 003D2F66
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 003D3006
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 003D3093
GetLastError.KERNEL32 ref: 003D30A0
Sleep.KERNEL32(00000064), ref: 003D30B4
CloseHandle.KERNEL32(?), ref: 003D311C

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 003D2F8A
%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 003D3063
7U=, xrefs: 003D2EBC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$7U=$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-132102203
Opcode ID: 5fb63972af400a87b866759313f049dd223b4b40f3456c2a2a1a2a95b8cbef44
Instruction ID: 6329019bdb14f183dcf23332cfa36f03dc666a0cb0de0bdde5f7ed87299e63e6
Opcode Fuzzy Hash: 5fb63972af400a87b866759313f049dd223b4b40f3456c2a2a1a2a95b8cbef44
Instruction Fuzzy Hash: FE71A573D01229ABDB329F64EC49BEAB7B8AB18710F1141A6F905A7391D7349F80CF51

Function 00416527 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,00416A99,?,?), ref: 0041657D
SysFreeString.OLEAUT32(00000000), ref: 004165E8
SysFreeString.OLEAUT32(00000000), ref: 00416660
SysFreeString.OLEAUT32(00000000), ref: 0041669F

Strings

scheme, xrefs: 00416590
term, xrefs: 004165B0
`<u, xrefs: 004165E8, 00416660, 0041669F
label, xrefs: 0041656F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$label$scheme$term
API String ID: 1324494773-4028212031
Opcode ID: 19d3391c85d4cfaee9b376817ee4bbadcd9f5c5ec27b8fa143f84ca3395d91cc
Instruction ID: 35ee7f4c7a3ac6a68cfa7d5bacf314ca044dd8eca9aaa887174e73a2e72db57e
Opcode Fuzzy Hash: 19d3391c85d4cfaee9b376817ee4bbadcd9f5c5ec27b8fa143f84ca3395d91cc
Instruction Fuzzy Hash: D3516231901119FFCB11DF94C944FEEBBB9AF04715F2142AAE811AB2A0D735EE90DB58

Function 003E4D1A Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 003E4D4D
StringFromGUID2.OLE32(?,?,00000027), ref: 003E4D7C
UuidCreate.RPCRT4(?), ref: 003E4DC7
StringFromGUID2.OLE32(?,?,00000027), ref: 003E4DF3

Strings

c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E4D8D, 003E4DDA
Failed to allocate pipe name., xrefs: 003E4DBC
Failed to allocate pipe secret., xrefs: 003E4E1C
Failed to create pipe guid., xrefs: 003E4D5A
Failed to convert pipe guid into string., xrefs: 003E4D99
BurnPipe.%s, xrefs: 003E4DA8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 4041566446-1070039060
Opcode ID: 70edb86ecd311c6efbbfb3589f1a6214248d76a09c5141b90c11f1049aaa58cf
Instruction ID: 8838c74fd252829fbfc07bde8cc6709ab3addcf5d4ddfbe1aa35610627ace10d
Opcode Fuzzy Hash: 70edb86ecd311c6efbbfb3589f1a6214248d76a09c5141b90c11f1049aaa58cf
Instruction Fuzzy Hash: 22418E32E00368ABDB12DFE5DD05EDFB7B8AB58711F214226E805BF281D6789A04CB51

Function 00416402 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,74DEDFD0), ref: 00416461
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 0041647E
SysFreeString.OLEAUT32(00000000), ref: 004164BC
SysFreeString.OLEAUT32(00000000), ref: 00416500

Strings

`jA, xrefs: 0041640B, 0041641D
uri, xrefs: 0041648C
email, xrefs: 00416470
`<u, xrefs: 004164BC, 00416500
name, xrefs: 00416453

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$CompareFree
String ID: `jA$`<u$email$name$uri
API String ID: 3589242889-2099898616
Opcode ID: 4c25b31171208634aa4aa12436598a534efb580478291d39b001e6bdd2953f89
Instruction ID: f3c83944ff01157a043b88f152a9638aa846d6ba5f2113eec0bb0743fd3f41e0
Opcode Fuzzy Hash: 4c25b31171208634aa4aa12436598a534efb580478291d39b001e6bdd2953f89
Instruction Fuzzy Hash: 3B417131D05219BBCF119B94CC44FEEB775AF04725F2282A9E921AB2D0C739DE84DB58

Function 003EE8CE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,003D54CB,?,?), ref: 003EE8EE
GetLastError.KERNEL32(?,003D54CB,?,?), ref: 003EE8FB
CreateThread.KERNEL32(00000000,00000000,003EE60C,?,00000000,00000000), ref: 003EE954
GetLastError.KERNEL32(?,003D54CB,?,?), ref: 003EE961
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,003D54CB,?,?), ref: 003EE99C
CloseHandle.KERNEL32(00000000,?,003D54CB,?,?), ref: 003EE9BB
CloseHandle.KERNEL32(?,?,003D54CB,?,?), ref: 003EE9C8

Strings

c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 003EE91C, 003EE982
Failed to create the UI thread., xrefs: 003EE98C
Failed to create initialization event., xrefs: 003EE926

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 2351989216-1290259148
Opcode ID: 88a9b115c97567cc5df01a946c3b0156858a588a6477a7bc03a302eff1a4a01e
Instruction ID: 8edd31e8a7b007b610f057f4806a4d1c7719c94fb47e3a017cfe580c703c3027
Opcode Fuzzy Hash: 88a9b115c97567cc5df01a946c3b0156858a588a6477a7bc03a302eff1a4a01e
Instruction Fuzzy Hash: 0631D576E01236BBE7129F9A9C44ADFBAFCAF04350F114176B900F7281E3389E0086A5

Function 003EE4A1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,003D54CB,?,?), ref: 003EE4C2
GetLastError.KERNEL32(?,?,003D54CB,?,?), ref: 003EE4CF
CreateThread.KERNEL32(00000000,00000000,003EE226,00000000,00000000,00000000), ref: 003EE52E
GetLastError.KERNEL32(?,?,003D54CB,?,?), ref: 003EE53B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,003D54CB,?,?), ref: 003EE576
CloseHandle.KERNEL32(?,?,?,003D54CB,?,?), ref: 003EE58A
CloseHandle.KERNEL32(?,?,?,003D54CB,?,?), ref: 003EE597

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 003EE4F0, 003EE55C
Failed to create modal event., xrefs: 003EE4FA
Failed to create UI thread., xrefs: 003EE566

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2351989216-1795443032
Opcode ID: 1b5f8bfc25b496fa629ab9bbd61c88652c4a7a68cfeea6f7f86121894221f032
Instruction ID: 8752c7ca1efe424a9e29555783ab6db6ffa5d25b8e6a73a0b11b41600cdcb0af
Opcode Fuzzy Hash: 1b5f8bfc25b496fa629ab9bbd61c88652c4a7a68cfeea6f7f86121894221f032
Instruction Fuzzy Hash: 57319776D01239BBD7229F9ADC05ADFBBB8AF45710F114266FD10F62D0E6389900CA95

Function 003F1286 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,74DF2F60,?,?), ref: 003F12AA
GetLastError.KERNEL32 ref: 003F12BD
GetExitCodeThread.KERNEL32(0041A488,00000000), ref: 003F12FF
GetLastError.KERNEL32 ref: 003F130D
ResetEvent.KERNEL32(0041A460), ref: 003F1348
GetLastError.KERNEL32 ref: 003F1352

Strings

Failed to reset operation complete event., xrefs: 003F1383
Failed to get extraction thread exit code., xrefs: 003F133E
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F12E4, 003F1334, 003F1379
Failed to wait for operation complete event., xrefs: 003F12EE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-3513947302
Opcode ID: 7ec63f8c4874f0c213e5a480fe9e8785ab6d9a4aaf9bcb73d3f4e6c21cc4044d
Instruction ID: 7e9e3fede60eb97ad326ce7d275442b7dba38976219bde293eb21c48e7f6f2b4
Opcode Fuzzy Hash: 7ec63f8c4874f0c213e5a480fe9e8785ab6d9a4aaf9bcb73d3f4e6c21cc4044d
Instruction Fuzzy Hash: 0131F775B4030AFBE711DF65AD01BBE76F8AF04311F10806AFA05EA2A0E739DE009B15

Function 003F13A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0041A478,?,00000000,?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000,?), ref: 003F13BD
GetLastError.KERNEL32(?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000,?,003D54C6,FFF9E89D,003D54C6), ref: 003F13C7
WaitForSingleObject.KERNEL32(0041A488,000000FF,?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000,?,003D54C6), ref: 003F1401
GetLastError.KERNEL32(?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000,?,003D54C6,FFF9E89D,003D54C6), ref: 003F140B
CloseHandle.KERNEL32(00000000,003D54C6,?,00000000,?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000), ref: 003F1456
CloseHandle.KERNEL32(00000000,003D54C6,?,00000000,?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000), ref: 003F1465
CloseHandle.KERNEL32(00000000,003D54C6,?,00000000,?,003DC198,?,003D53FA,00000000,?,003E7740,?,003D56AA,003D54B6,003D54B6,00000000), ref: 003F1474

Strings

Failed to wait for thread to terminate., xrefs: 003F1439
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F13EB, 003F142F
Failed to set begin operation event., xrefs: 003F13F5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1206859064-3195532870
Opcode ID: d94dcb7b1622cc6a437149eb161f848dbfee9e10ebd51c2b21a453e1b3ef2f3f
Instruction ID: 1f09417079c26d7775d57677bf0e5a20bcc8a6b52a371c24fa3b4abf12a3614d
Opcode Fuzzy Hash: d94dcb7b1622cc6a437149eb161f848dbfee9e10ebd51c2b21a453e1b3ef2f3f
Instruction Fuzzy Hash: C2212833601526F7D3235B26FC05765BAB4BF04721F124226EA0466D90D778AC60DAD9

Function 003E92CD Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 003E9380
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 003E93A8

Strings

Could not close verify handle., xrefs: 003E9537
Could not verify file %ls., xrefs: 003E94E9
Failed to allocate memory, xrefs: 003E933E
Failed to allocate string., xrefs: 003E9416
Failed to get file hash., xrefs: 003E93D2
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E93C8, 003E94DC, 003E952D
Failed to encode file hash., xrefs: 003E9433
0, xrefs: 003E9440
$, xrefs: 003E947F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1452528299-3123085469
Opcode ID: 9c261352b3ef2f837adb3c53b42b264b41650ab3f97b3c3834c744b90d0ca638
Instruction ID: cddb6802822529b917fb1d10007553502d1c479ac08730a8bd6cf947c2c05a27
Opcode Fuzzy Hash: 9c261352b3ef2f837adb3c53b42b264b41650ab3f97b3c3834c744b90d0ca638
Instruction Fuzzy Hash: E1819576D00279ABDB22DB96D841BEEB7B8AF08710F110227F910BB2C1D7349D45CBA4

Function 003EE3C8 Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 003EE3D3
DefWindowProcW.USER32(?,00000082,?,?), ref: 003EE411
SetWindowLongW.USER32(?,000000EB,00000000), ref: 003EE41E
SetWindowLongW.USER32(?,000000EB,?), ref: 003EE42D
DefWindowProcW.USER32(?,?,?,?), ref: 003EE43B
CreateCompatibleDC.GDI32(?), ref: 003EE447
SelectObject.GDI32(00000000,00000000), ref: 003EE458
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 003EE47A
SelectObject.GDI32(00000000,00000000), ref: 003EE482
DeleteDC.GDI32(00000000), ref: 003EE485
PostQuitMessage.USER32(00000000), ref: 003EE493

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 3eb01d9d1654943a93fbc42e2eb9ed95f43b586f17d7ee0d11b46d32223bd35c
Instruction ID: f02349c18af6b04383cc18afaeaf0ad3a52f4d6c51e68c188cd88111d329ab26
Opcode Fuzzy Hash: 3eb01d9d1654943a93fbc42e2eb9ed95f43b586f17d7ee0d11b46d32223bd35c
Instruction Fuzzy Hash: 1D21C432105254BFDB169F76DC1CEBB3F69FB49320B068628FA16961F0D2318820DB65

Function 003EA00C Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

WixBundleLayoutDirectory, xrefs: 003EA149
Failed to combine last source with source., xrefs: 003EA0EE
Failed to combine layout source with source., xrefs: 003EA183
WixBundleLastUsedSource, xrefs: 003EA075
WixBundleOriginalSource, xrefs: 003EA090
Failed to get bundle layout directory property., xrefs: 003EA164
Failed to copy source path., xrefs: 003EA1FD
Failed to get current process directory., xrefs: 003EA0CF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: 6d422fcdd5a8f59928f8f0f3915d980e624168bebc8fbefe6ef5146d36702651
Instruction ID: 87e76a6d8bda9a67b2f3f208a3e319bc61f6d25b3b48c555cc5177520d9645bf
Opcode Fuzzy Hash: 6d422fcdd5a8f59928f8f0f3915d980e624168bebc8fbefe6ef5146d36702651
Instruction Fuzzy Hash: 64817172D00669AFCF13DF99E841AEEBBB5AF08310F15062AF911B7290D775AD40CB52

Function 003D3171 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 003D31BC
GetLastError.KERNEL32 ref: 003D31C2
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 003D321C
GetLastError.KERNEL32 ref: 003D3222
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 003D32D6
GetLastError.KERNEL32 ref: 003D32E0
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 003D3336
GetLastError.KERNEL32 ref: 003D3340

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 003D31E6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-4168559387
Opcode ID: a2bf84ae21789bdc039c346ccd0ed3ddb7196fb17b44b99f0e44589eba0c88b9
Instruction ID: c226729aa1b097597db7e0f6ac9f34d1f64df7b5dd6f6ccc53e0775707ece1e9
Opcode Fuzzy Hash: a2bf84ae21789bdc039c346ccd0ed3ddb7196fb17b44b99f0e44589eba0c88b9
Instruction Fuzzy Hash: FB619277D01229ABDB239AE4E945BDE7A68AF00760F164567EE00BB350E735DF0087D2

Function 003DCB82 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,003D53FA,00000000,003D54C6,003D5482,WixBundleUILevel,840F01E8,?,00000001), ref: 003DCBD9

Strings

Failed to extract file., xrefs: 003DCCA4
Payload was not found in container: %ls, xrefs: 003DCCE6
Failed to find embedded payload: %ls, xrefs: 003DCC05
c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 003DCCDA
Failed to ensure directory exists, xrefs: 003DCCAB
Failed to get directory portion of local file path, xrefs: 003DCCB2
Failed to concat file paths., xrefs: 003DCCB9
Failed to get next stream., xrefs: 003DCCC0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\66\s\src\burn\engine\payload.cpp
API String ID: 1825529933-3317369491
Opcode ID: 58da864f5434c49e07855c35dcb0a2ec90ed9a83725b807dbd9752558d7c0ce8
Instruction ID: 3394158e6cf481bca81279d4fab6f025df52c1e8a7d1baa651e3a18c55dfbda1
Opcode Fuzzy Hash: 58da864f5434c49e07855c35dcb0a2ec90ed9a83725b807dbd9752558d7c0ce8
Instruction Fuzzy Hash: 8541D033930216ABCF27DF54ED41AAEBB79BF00710B21516BF915AB351C2709D42DB90

Function 003D47DF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 003D4804
GetCurrentThreadId.KERNEL32 ref: 003D480A
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 003D4898

Strings

wininet.dll, xrefs: 003D4837
Failed to load UX., xrefs: 003D484D
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 003D48E4
Failed to create engine for UX., xrefs: 003D4824
Unexpected return value from message pump., xrefs: 003D48EE
Failed to start bootstrapper application., xrefs: 003D4866

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$wininet.dll
API String ID: 673430819-1140212773
Opcode ID: ab22a1cc7c229a676c992ebf719cbe3293b0e0a8c628925e1cadd6d40a3dd70e
Instruction ID: d1f2fb70b6ff7aef5e02663c4b8508c9a884b5dbae7f108b5984a7c84729ab23
Opcode Fuzzy Hash: ab22a1cc7c229a676c992ebf719cbe3293b0e0a8c628925e1cadd6d40a3dd70e
Instruction Fuzzy Hash: C541CF72A00615BFEB129BA4EC85EBB77ACEF04354F200127F915EB280DB35ED4597A1

Function 003F99B4 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,003FAD39,?,00000001,00000000), ref: 003F9A3F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,003FAD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 003F9A49
CopyFileExW.KERNEL32(00000000,00000000,003F988D,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 003F9A97
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,003FAD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 003F9AC6

Strings

Failed to clear readonly bit on payload destination path: %ls, xrefs: 003F9A78
copy, xrefs: 003F9A0D
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 003F9ABF
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 003F9A6D, 003F9AB1, 003F9AEA
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 003F9AF8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$copy
API String ID: 1969131206-3140072123
Opcode ID: 893f388500b9362ca811f415e0f3c88e1112266cfe59ca905a360b9393b89d5f
Instruction ID: 758b6cb91c361c388726ed1ba5183c15ac349c50b6909174847e629750326895
Opcode Fuzzy Hash: 893f388500b9362ca811f415e0f3c88e1112266cfe59ca905a360b9393b89d5f
Instruction Fuzzy Hash: FF314733B01129B7DB229A568C46FBB776CAF81B50B16816BBE05EB241D378CD00C6E4

Function 003E8D91 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 003E8EDC

Strings

Failed to allocate access for SYSTEM group to path: %ls, xrefs: 003E8E05
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E8E85
Failed to allocate access for Users group to path: %ls, xrefs: 003E8E47
Failed to secure cache path: %ls, xrefs: 003E8EBF
Failed to allocate access for Administrators group to path: %ls, xrefs: 003E8DE4
Failed to allocate access for Everyone group to path: %ls, xrefs: 003E8E26
Failed to create ACL to secure cache path: %ls, xrefs: 003E8E90

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2826327444-3220527011
Opcode ID: 35657a78c2cd34d22eeedca792d81e6c01685b942b5c931cf1f76d74cba06192
Instruction ID: 580d643663e90177d661120f1d2cfdc1ff297f6e7685614f54d8d80521c77d20
Opcode Fuzzy Hash: 35657a78c2cd34d22eeedca792d81e6c01685b942b5c931cf1f76d74cba06192
Instruction Fuzzy Hash: DF31F772E403BAB7DB3397518D02FAF766CAB80B10F514265BA08FA1C0DEB5AD44D794

Function 003DF3F9 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003DF432

Part of subcall function 003D415F: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,003E9FBC,00000000,00000000,?,00000000,003D53FA,00000000,?,?,003DD567,?), ref: 003D416D
Part of subcall function 003D415F: GetLastError.KERNEL32(?,003E9FBC,00000000,00000000,?,00000000,003D53FA,00000000,?,?,003DD567,?,00000000,00000000), ref: 003D417B

lstrlenA.KERNEL32(002E0032,00000000,00000094,00000000,00000094,crypt32.dll,crypt32.dll,003E0458,swidtag,00000094,0041A500,00330074,003E0458,00000000,crypt32.dll,00000000), ref: 003DF485

Part of subcall function 004145C9: CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,003E0458,00000000,?,003DF49C,0041A500,00000080,002E0032,00000000), ref: 004145E1
Part of subcall function 004145C9: GetLastError.KERNEL32(?,003DF49C,0041A500,00000080,002E0032,00000000,?,003E0458,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 004145EE

Strings

Failed to write tag xml to file: %ls, xrefs: 003DF4C3
crypt32.dll, xrefs: 003DF422, 003DF45F, 003DF460
Failed to allocate regid folder path., xrefs: 003DF4E4
swidtag, xrefs: 003DF445
Failed to create regid folder: %ls, xrefs: 003DF4CD
Failed to format tag folder path., xrefs: 003DF4EB
Failed to allocate regid file path., xrefs: 003DF4DD

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$crypt32.dll$swidtag
API String ID: 904508749-2959304021
Opcode ID: a72c477cc033e0813dd72bf63567f33326b35fea52f4957a37bfd77d22ab8846
Instruction ID: af52e53f2a27e30f6cdd76a8923d589f7394cb46ab04c3f2167f459e5d05baa2
Opcode Fuzzy Hash: a72c477cc033e0813dd72bf63567f33326b35fea52f4957a37bfd77d22ab8846
Instruction Fuzzy Hash: 0E319D32D00225FFCB12AFA4EC81B9EBBB5AF14710F2081B7F815BA351D7749A509B94

Function 003EE10F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 003EE145
GetLastError.KERNEL32 ref: 003EE151
GetObjectW.GDI32(00000000,00000018,?), ref: 003EE198
GetCursorPos.USER32(?), ref: 003EE1B9
MonitorFromPoint.USER32(?,?,00000002), ref: 003EE1CB
GetMonitorInfoW.USER32(00000000,?), ref: 003EE1E1

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 003EE175
(, xrefs: 003EE1D8
Failed to load splash screen bitmap., xrefs: 003EE17F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2342928100-3540601290
Opcode ID: a95807d69381ef096858305b188d2903bab0501eb44bfdfd560b96a41c780472
Instruction ID: 30f7be8a673133cc06722938f82f625027a3bd27dc6dbf7ec8e26103d8750dd0
Opcode Fuzzy Hash: a95807d69381ef096858305b188d2903bab0501eb44bfdfd560b96a41c780472
Instruction Fuzzy Hash: C4318175A01219AFDB11DFA9D945B9EBBF5EF08710F11C129F904EB281DB30E904CBA5

Function 003E5053 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,0041A500), ref: 003E505C
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 003E50FA
CloseHandle.KERNEL32(00000000), ref: 003E5113

Strings

Failed to allocate parameters for elevated process., xrefs: 003E5095
Failed to launch elevated child process: %ls, xrefs: 003E50E7
open, xrefs: 003E50C4, 003E50D2
burn.elevated, xrefs: 003E507C
runas, xrefs: 003E50BA
-q -%ls %ls %ls %u, xrefs: 003E5081

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 4ec22aaf064b434d8baa79eca4e76c4f60e73a8222e994d718529996f70e1aab
Instruction ID: b39fb801e8ded971d82547751fb6da221ce9d2cda332540538856ab278956125
Opcode Fuzzy Hash: 4ec22aaf064b434d8baa79eca4e76c4f60e73a8222e994d718529996f70e1aab
Instruction Fuzzy Hash: E9218DB1A00629FFCF12DF95DC418AEBB78EF04319B10857AF801A2251D7399F50DB94

Function 003D6898 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 003D68C2
GetProcAddress.KERNEL32(00000000), ref: 003D68C9
GetLastError.KERNEL32 ref: 003D68D3

Strings

DllGetVersion, xrefs: 003D68B4
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D68F7
msi, xrefs: 003D68B9
Failed to get msi.dll version info., xrefs: 003D691B
Failed to set variant value., xrefs: 003D693F
Failed to find DllGetVersion entry point in msi.dll., xrefs: 003D6901

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$msi
API String ID: 4275029093-3573271201
Opcode ID: 88bb32b1f8a5cbfad726a7b2b7585cc247d1f2f2e9985ff907c558cf13ed885b
Instruction ID: af8b7de56fe5f2b64957920e354404d15d63ac591a1df483b4255471e19d1ad0
Opcode Fuzzy Hash: 88bb32b1f8a5cbfad726a7b2b7585cc247d1f2f2e9985ff907c558cf13ed885b
Instruction Fuzzy Hash: 1A110673A4063567D712AB789C92BFF7BA4EB08B11B11002AFE01F6281D738DD4482E9

Function 003DD679 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,003D4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,003D54CB,?), ref: 003DD68A
GetLastError.KERNEL32(?,003D4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,003D54CB,?,?), ref: 003DD697
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 003DD6CF
GetLastError.KERNEL32(?,003D4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,003D54CB,?,?), ref: 003DD6DB

Strings

BootstrapperApplicationCreate, xrefs: 003DD6C9
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 003DD6B8, 003DD6FC
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 003DD706
Failed to load UX DLL., xrefs: 003DD6C2
Failed to create UX., xrefs: 003DD71F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-3967977479
Opcode ID: f3a7751c67b54e0b2a3dafeb191d06513c42710dfe67ab1187816cc93e212a03
Instruction ID: 9cc61d154fea4613365d4c19123eac5772bf11e2d8a6180426e61a36f4ed760c
Opcode Fuzzy Hash: f3a7751c67b54e0b2a3dafeb191d06513c42710dfe67ab1187816cc93e212a03
Instruction Fuzzy Hash: 3211EB37A81B32B7D7235EA4AC05F9B3A946B05B61F124177FE05FB380EA29DC044AD5

Function 003D1173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D1184
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 003D119D
GetLastError.KERNEL32(?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D11B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 003D11C0
GetLastError.KERNEL32(?,?,?,?,?,003D111A,cabinet.dll,00000009,?,?,00000000), ref: 003D11D5

Strings

SetDefaultDllDirectories, xrefs: 003D1197
kernel32, xrefs: 003D118A
SetDllDirectoryW, xrefs: 003D11BA

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: 911f77fb4216b290229b67bcee86615b14436fd0797772e217771bd709947e6d
Instruction ID: 54fd43b8c50ffe223bde1125efefccdc9eb720ee3246161b552b51195abb8c8c
Opcode Fuzzy Hash: 911f77fb4216b290229b67bcee86615b14436fd0797772e217771bd709947e6d
Instruction Fuzzy Hash: C201D8723012167B97126F66AC05EEF3F6DFF447617018022F905A1141E674DA558BB6

Function 003EF47A Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003EF48F
LeaveCriticalSection.KERNEL32(?), ref: 003EF60A

Strings

Engine is active, cannot change engine state., xrefs: 003EF4A9
UX requested unknown container with id: %ls, xrefs: 003EF534
Failed to set download user., xrefs: 003EF592
UX requested unknown payload with id: %ls, xrefs: 003EF4E4
UX did not provide container or payload id., xrefs: 003EF5F9
Failed to set download password., xrefs: 003EF5B8
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 003EF4FA
Failed to set download URL., xrefs: 003EF569

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 6ba67725ef2be2484074f9f0ee99d78120cd1e4d142273190b9505f62f0f480a
Instruction ID: 5dbbf341afb00ceaf6121a9635e8a7e16dad201a54330c0c4306082a063fe905
Opcode Fuzzy Hash: 6ba67725ef2be2484074f9f0ee99d78120cd1e4d142273190b9505f62f0f480a
Instruction Fuzzy Hash: 0241EB72610271EFCB239F26D805B6A73A8AF22710F254277F805AB2C1E7B4ED40C794

Function 00405835 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00405849

Part of subcall function 00405CE8: HeapFree.KERNEL32(00000000,00000000,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?), ref: 00405CFE
Part of subcall function 00405CE8: GetLastError.KERNEL32(?,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?,?), ref: 00405D10

_free.LIBCMT ref: 00405855
_free.LIBCMT ref: 00405860
_free.LIBCMT ref: 0040586B
_free.LIBCMT ref: 00405876
_free.LIBCMT ref: 00405881
_free.LIBCMT ref: 0040588C
_free.LIBCMT ref: 00405897
_free.LIBCMT ref: 004058A2
_free.LIBCMT ref: 004058B0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0054c0b7e1c6cb8bcfbd5b9ea67d62a3f13dd6d047fd136abf236c3e060c084c
Instruction ID: ed866981b31a088fc8b13c51bb770bad723eedb9fc793820c2b079c3c2041317
Opcode Fuzzy Hash: 0054c0b7e1c6cb8bcfbd5b9ea67d62a3f13dd6d047fd136abf236c3e060c084c
Instruction Fuzzy Hash: F311A776504608AFDB01EF55C942CDE3BA5FF05354B8180BABA086B2A2DA35DE50DF84

Function 00415253 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00415290
GetLastError.KERNEL32 ref: 0041529E
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 004152DF
GetLastError.KERNEL32 ref: 004152EC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 0041545F
CloseHandle.KERNEL32(?), ref: 0041546E

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 004152C2
GET, xrefs: 00415393

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-547604341
Opcode ID: a2a722552247e4345908885726bf160afce576eee1b669eac498643e19dbe6cd
Instruction ID: d1d694f15e7a72187fa6347aa5246f92105c573a8387418006736abb214b9a70
Opcode Fuzzy Hash: a2a722552247e4345908885726bf160afce576eee1b669eac498643e19dbe6cd
Instruction Fuzzy Hash: 87617D76A0061AEBDB11CFA4DC44BEF7BB8AF88355F11412AFD14B7240D778D9908B98

Function 003E0BE7 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 003E0FB3: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,003E0C06,?,00000000,?,00000000,00000000), ref: 003E0FE2

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 003E0D8A
GetLastError.KERNEL32 ref: 003E0D97

Strings

Failed to append payload cache action., xrefs: 003E0D41
c:\agent\_work\66\s\src\burn\engine\plan.cpp, xrefs: 003E0DBB
Failed to create syncpoint event., xrefs: 003E0DC5
Failed to append rollback cache action., xrefs: 003E0C66
Failed to append package start action., xrefs: 003E0C2C
Failed to append cache action., xrefs: 003E0CE1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$c:\agent\_work\66\s\src\burn\engine\plan.cpp
API String ID: 801187047-574661624
Opcode ID: 5e389c5ab0c8224722dcc4f8322a6372ec21e04308493d734d53911058c0e40f
Instruction ID: f54f6af489496ab07837e4b9e44caa1438b26aae65f933db7e3aba30be15763e
Opcode Fuzzy Hash: 5e389c5ab0c8224722dcc4f8322a6372ec21e04308493d734d53911058c0e40f
Instruction Fuzzy Hash: AC61A075500655EFCB06DF65C980AAEBBF9EF84310F21816AE8059F391E770ED81DB50

Function 004166D4 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,type,000000FF,?,74DEDFD0,74DEDFD0,74DEDFD0), ref: 0041672A
SysFreeString.OLEAUT32(00000000), ref: 00416775
SysFreeString.OLEAUT32(00000000), ref: 004167F1
SysFreeString.OLEAUT32(00000000), ref: 0041683D

Strings

`<u, xrefs: 00416775, 004167F1, 0041683D
url, xrefs: 0041673D
type, xrefs: 0041671C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$type$url
API String ID: 1324494773-1686489133
Opcode ID: 9e3bb36c25b43ae574b1af182763c9a1c37cd4701980de9a725268cdff952da2
Instruction ID: ad5398b463b4bd0adcf9ef4e82ed8125e58d0d8435ea4a9a3df6d475ad1a32b8
Opcode Fuzzy Hash: 9e3bb36c25b43ae574b1af182763c9a1c37cd4701980de9a725268cdff952da2
Instruction Fuzzy Hash: 42515D35902119FFCB11DF94C984FEEBBB8AF04715F1541AAE821AB2A0D739DE80DB54

Function 003D9E89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9EAF
_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9ED4

Strings

Failed to get component path: %d, xrefs: 003D9F38
Failed to format component id string., xrefs: 003D9EBA
Failed to set variable., xrefs: 003D9FB8
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 003D9FC8
Failed to format product code string., xrefs: 003D9EDF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: 09ca1be18bc7a065acbb3a8d4451715d4e4a50370259e798f662c6afd5826d96
Instruction ID: bee6391df61804ad39da2d81f608f60d101943a304519c1340a5315d2324fedd
Opcode Fuzzy Hash: 09ca1be18bc7a065acbb3a8d4451715d4e4a50370259e798f662c6afd5826d96
Instruction Fuzzy Hash: 4E410273904215BACB279BA8AC42BBEB77DEF00311F254627F500E6391E771D990D791

Function 0040FBC6 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 0040FC0A
GetComputerNameW.KERNEL32(?,?), ref: 0040FC62

Strings

--- logging level: %hs ---, xrefs: 0040FD22
ZC, xrefs: 0040FD03
=== Logging started: %ls ===, xrefs: 0040FC8D
ZC, xrefs: 0040FCFB
Computer : %ls, xrefs: 0040FCD0
Executable: %ls v%d.%d.%d.%d, xrefs: 0040FCBE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d$ZC$ZC
API String ID: 2577110986-2307284708
Opcode ID: 5415bb679ef6fff6b79e629566d78ac458cd9ea06e811d8ef67c2bad5bb641c7
Instruction ID: d5fc9601291f9cd896f09e9dfac2a156316eab88edc17c4d017e85099b6c4698
Opcode Fuzzy Hash: 5415bb679ef6fff6b79e629566d78ac458cd9ea06e811d8ef67c2bad5bb641c7
Instruction Fuzzy Hash: 094154F294011C9BDB20DF64DC85AEA77BCEB54304F1041BBF905F3682D734AE888A69

Function 003E48B9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000001,00000008,?,00000000,?,00000000,00000000,00000001,00000000,?,?,?,00000000,crypt32.dll,00000000), ref: 003E48E4
GetLastError.KERNEL32 ref: 003E48F1
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 003E499C
GetLastError.KERNEL32 ref: 003E49A6

Strings

c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E4950, 003E4967, 003E49CA
Failed to allocate data for message., xrefs: 003E495A
Failed to read message from pipe., xrefs: 003E4971
Failed to read data for message., xrefs: 003E49D4

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1948546556-3469126999
Opcode ID: 668a9ae36b7c363759e5f9ee6c04b2f7f43db86762cda7601112cc7be457a3e8
Instruction ID: 48e7b772889ec99a938e33696770658f14a1e50ed58fc966528c0a8586025de8
Opcode Fuzzy Hash: 668a9ae36b7c363759e5f9ee6c04b2f7f43db86762cda7601112cc7be457a3e8
Instruction Fuzzy Hash: B631D733E4027ABBD712DE66DC05BABF668AF08751F128236BD40B62C1D7789E0486D5

Function 00410E2F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 00410E6B
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00410ECD
lstrlenW.KERNEL32(?), ref: 00410ED9
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00410F1C

Strings

BundleUpgradeCode, xrefs: 00410E38
<]C, xrefs: 00410E49
<]C, xrefs: 00410EAD, 00410EC4
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00410F44

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: lstrlen$Value
String ID: <]C$<]C$BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 198323757-4242281152
Opcode ID: e8474418fbc396fdc2c7e863ef340c60efac4c51dfabb1ad1539df3476ae12c3
Instruction ID: 5ccad49f9c1e986f4f3ed929ce3f205f9bcf0cac25e1e9ed193b4bc1ecfd91f8
Opcode Fuzzy Hash: e8474418fbc396fdc2c7e863ef340c60efac4c51dfabb1ad1539df3476ae12c3
Instruction Fuzzy Hash: 77316272900229AFCB22DF98DD85ADEBB79FF44750F014566FD04AB210C7B4DD928BA4

Function 003E5365 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,003D54CB,00000000,00000000,?,00000000), ref: 003E540E
GetLastError.KERNEL32(?,?,?,003D4CA6,?,?,00000000,?,?,?,?,?,?,0041A4A0,?,?), ref: 003E5419

Strings

c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E543D
Failed to post terminate message to child process cache thread., xrefs: 003E53DD
Failed to write exit code to message buffer., xrefs: 003E5389
Failed to wait for child process exit., xrefs: 003E5447
Failed to post terminate message to child process., xrefs: 003E53F9
Failed to write restart to message buffer., xrefs: 003E53B1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1211598281-389050287
Opcode ID: 0c66b06377608fca7183fbae89adf0d16307c49e99e0b54b77c59c5443849c80
Instruction ID: e10a287d9ace355a530c6108d4ebdd39f2f9e9e2a667e4e21a39e48b0729c43b
Opcode Fuzzy Hash: 0c66b06377608fca7183fbae89adf0d16307c49e99e0b54b77c59c5443849c80
Instruction Fuzzy Hash: 49212B33940A79BBCB135E52DC01F9E7779AF0036AF610326F900BA1D0D778AE409AD5

Function 003E8F6B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,003E9DDA,00000003,000007D0,00000003,?,000007D0), ref: 003E8F85
GetLastError.KERNEL32(?,003E9DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 003E8F92
CloseHandle.KERNEL32(00000000,?,003E9DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 003E905A

Strings

Failed to verify signature of payload: %ls, xrefs: 003E9002
Failed to verify catalog signature of payload: %ls, xrefs: 003E9021
Failed to open payload at path: %ls, xrefs: 003E8FD6
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E8FC9
Failed to verify hash of payload: %ls, xrefs: 003E9045

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2528220319-1480445316
Opcode ID: ee3aaebafb49db537bb97af2d06884d5482e9f3846236dccd38de56ebec16382
Instruction ID: 813a7b6ba2d10d47591c26b414741487d5e3c49659bcc6ee3680771b3687c03d
Opcode Fuzzy Hash: ee3aaebafb49db537bb97af2d06884d5482e9f3846236dccd38de56ebec16382
Instruction Fuzzy Hash: BF214332A40679FBCB331A66AC04B9A3A29AF00774F528323FD00295D0D3399D60DBC5

Function 003D6B30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 003D6B7B
GetLastError.KERNEL32 ref: 003D6B85
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 003D6BC9
GetLastError.KERNEL32 ref: 003D6BD3

Strings

Failed to get volume path name., xrefs: 003D6C01
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D6BA9, 003D6BF7
Failed to set variant value., xrefs: 003D6C1D
Failed to get windows directory., xrefs: 003D6BB3

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 124030351-26183806
Opcode ID: daf8dbbbb1668f319867f63575a990ba9e7f1462e0628c222ab166fdc1cb7f4a
Instruction ID: 4edd5f07a226066766745b0cccdf88f0cdedb5e89da67f2a207e8546e0be5d75
Opcode Fuzzy Hash: daf8dbbbb1668f319867f63575a990ba9e7f1462e0628c222ab166fdc1cb7f4a
Instruction Fuzzy Hash: 892107B3E4123867D7229655AC06FDA766C9F04710F114177BE04FB281EA389E4086E9

Function 003D9C2D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9C46
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,003DA86A,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 003D9C5E
GetLastError.KERNEL32(?,003DA86A,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 003D9C6B

Strings

c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 003D9C9B
Failed to set variable., xrefs: 003D9CF4
File search: %ls, did not find path: %ls, xrefs: 003D9CBD
Failed get to file attributes. '%ls', xrefs: 003D9CA8
Failed to format variable string., xrefs: 003D9C51

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1811509786-3902182656
Opcode ID: 23128c7570e6ab806c9843df276af46782977d009345d4917f3c937de5643eca
Instruction ID: 64473594a15c3ab8cd43561e61bc762863ea1e08309078b23f5ee852eb10730b
Opcode Fuzzy Hash: 23128c7570e6ab806c9843df276af46782977d009345d4917f3c937de5643eca
Instruction Fuzzy Hash: 05214933D50121B7DB236664AC07B9EBA65AF00720F224237FD11B7391E7759D50A6D4

Function 003EAC12 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 003EAC29
GetLastError.KERNEL32 ref: 003EAC33
CoInitializeEx.OLE32(00000000,00000000), ref: 003EAC72
CoUninitialize.OLE32(?,003EC5CA,?,?), ref: 003EACAF

Strings

Failed to set elevated cache pipe into thread local storage for logging., xrefs: 003EAC61
Failed to pump messages in child process., xrefs: 003EAC9D
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 003EAC57
Failed to initialize COM., xrefs: 003EAC7E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 876858697-588708458
Opcode ID: a3ba5382d8cf9481396449df236d1f9f352a4f8f49bc74d36691598d1bcaf044
Instruction ID: df694850fa9110bebd2dab5afe47a914314064849c100009415f8ec775fc9c65
Opcode Fuzzy Hash: a3ba5382d8cf9481396449df236d1f9f352a4f8f49bc74d36691598d1bcaf044
Instruction Fuzzy Hash: 8A11E3739519757B862357529C09A9ABE68AF05B607224326FC01F6280E674BD1086DA

Function 003D5D14 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 003D5D9A

Part of subcall function 0041095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004109D4
Part of subcall function 0041095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00410A0C

Strings

ProgramFilesDir, xrefs: 003D5D29
+, xrefs: 003D5D1C
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 003D5D37
Failed to ensure path was backslash terminated., xrefs: 003D5D84
Failed to open Windows folder key., xrefs: 003D5D4C
Failed to read folder path for '%ls'., xrefs: 003D5D66
CommonFilesDir, xrefs: 003D5D22, 003D5D56, 003D5D65

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: 41f7123ed91e58a47bc180d29bd88ef05c452819edd25e9a9af274c9b271bdf2
Instruction ID: f945f30eda57fd376925eff4b697c979e80400d96ba885a721a4d3bf98622921
Opcode Fuzzy Hash: 41f7123ed91e58a47bc180d29bd88ef05c452819edd25e9a9af274c9b271bdf2
Instruction Fuzzy Hash: 4501F533980624BBCB235A55FC5AFDE7A29DB11764F208027F808B6351D7789E80D6E8

Function 00409A87 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,t,@,00402C74,?,?,?,00409CD8,00000001,00000001,BCE85006), ref: 00409AE1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00409CD8,00000001,00000001,BCE85006,?,?,?), ref: 00409B67
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,BCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00409C61
__freea.LIBCMT ref: 00409C6E

Part of subcall function 00405D22: HeapAlloc.KERNEL32(00000000,?,?,?,00401782,?,0000015D,?,?,?,?,00402BDB,000000FF,00000000,?,?), ref: 00405D54

__freea.LIBCMT ref: 00409C77
__freea.LIBCMT ref: 00409C9C

Strings

t,@, xrefs: 00409A99

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID: t,@
API String ID: 3147120248-3813946272
Opcode ID: d45f299ca740eacc8ca6b038210bbd835a89220d9b306de46dd4372a87adeb80
Instruction ID: a6358eded322f26f43ca229a422b8ac547e8628b9518fd41c8a5cacdbb067d45
Opcode Fuzzy Hash: d45f299ca740eacc8ca6b038210bbd835a89220d9b306de46dd4372a87adeb80
Instruction Fuzzy Hash: 12510572A00216ABEB258F64CC81EBB77AAEF40750F14463EFD05E62D2DB38DC40C658

Function 003F9FA3 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,00000000,?), ref: 003FA070
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 003FA07A

Strings

Failed to clear readonly bit on payload destination path: %ls, xrefs: 003FA0A9
download, xrefs: 003FA03A
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 003FA09E
:, xrefs: 003FA0F3
Failed attempt to download URL: '%ls' to: '%ls', xrefs: 003FA157

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$download
API String ID: 1799206407-2514864748
Opcode ID: 8f9d7a19af537b9a9305178bf7c624d0f1a5ade89e9f5de8288a8d2f7a7d4498
Instruction ID: 93755f9c7fe2c36c8907d3ad0af6e016093f8e3ccd2361c2e3f62a2ea0d91630
Opcode Fuzzy Hash: 8f9d7a19af537b9a9305178bf7c624d0f1a5ade89e9f5de8288a8d2f7a7d4498
Instruction Fuzzy Hash: C951C4B1A00619AFDB22DFA5C841BFEB7B8BF04710F11845AFA05EB241E775DA40CB91

Function 00417C88 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,003F8D9E,000002C0,00000100), ref: 00417CB6
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,003F8D9E,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00417CD1

Strings

application, xrefs: 00417CC3
http://appsyndication.org/2006/appsyn, xrefs: 00417CA9
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 00417D6C
type, xrefs: 00417CF8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-536847345
Opcode ID: c11250620d0ae8945961462123cd2007f330eee5fc6fa856f19462cf51e37588
Instruction ID: 6b193e1b0fe47ec15cb01fd6be73650644830036e7b326d4ec32ce3e7271b97f
Opcode Fuzzy Hash: c11250620d0ae8945961462123cd2007f330eee5fc6fa856f19462cf51e37588
Instruction Fuzzy Hash: 8D51C331644306ABDB219F14DC81FAB77B5AF00720F20855AFA299B3D1D778ED80CB58

Function 00415C9E Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00415CFA
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00415DF1
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00415E00

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00415D1E
Burn, xrefs: 00415CE9
WiX\Burn, xrefs: 00415D38
DownloadTimeout, xrefs: 00415D33

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3522763407-1474791565
Opcode ID: b9fe546f56af0923daf3c45ee900aa7bd9a2da1844f80df8a2536b39546665c4
Instruction ID: a146b770b7e269eeb11f54c07ce517cb71d52c3d1a8322bd84775a01d012b6c7
Opcode Fuzzy Hash: b9fe546f56af0923daf3c45ee900aa7bd9a2da1844f80df8a2536b39546665c4
Instruction Fuzzy Hash: 99516D72D00619FBDB12DFA4DC45EEFBBB9EF48710F114166FA10E6150E7388A509BA4

Function 003E9158 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 003E91E6

Part of subcall function 00414ED0: GetLastError.KERNEL32(?,?,003E920B,?,00000003,003D54C6,?), ref: 00414EEF

_memcmp.LIBVCRUNTIME ref: 003E9220
GetLastError.KERNEL32 ref: 003E9298

Strings

Failed to read certificate thumbprint., xrefs: 003E928C
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E92BC
Failed to find expected public key in certificate chain., xrefs: 003E925B
Failed to get certificate public key identifier., xrefs: 003E92C6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3038490147
Opcode ID: 9c64ac793cce4895239fd1d24d9caaef1cae42915939b03c61d08b34ed91e024
Instruction ID: b8cc7878fcfb8f7f7deac667894f20c61037c82fd5a78ef316d423668bf344ad
Opcode Fuzzy Hash: 9c64ac793cce4895239fd1d24d9caaef1cae42915939b03c61d08b34ed91e024
Instruction Fuzzy Hash: 69415472E00229ABDF11DBA5D841FEEB7B8BF08710F114666FA04F7281D674ED008BA4

Function 003E0539 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 003E066A
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 003E0679

Part of subcall function 004104A5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,003E05B1,?,00000000,00020006), ref: 004104CA

Strings

Failed to open registration key., xrefs: 003E06AF
Failed to update resume mode., xrefs: 003E064E
%ls.RebootRequired, xrefs: 003E0587
Failed to write volatile reboot required registry key., xrefs: 003E05B5
Failed to delete registration key: %ls, xrefs: 003E0618

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: df40c997aabcc834d0b8fff36acfd1e376707ab2f963564cd4fb2d3213ea0d9b
Instruction ID: 29f9dff410006a70caf5c224f64ac5721ea8838d8ffdee854fc28137c7829ebf
Opcode Fuzzy Hash: df40c997aabcc834d0b8fff36acfd1e376707ab2f963564cd4fb2d3213ea0d9b
Instruction Fuzzy Hash: 45419332900224FBDF23AFA2DC02FAF7BB9EF90314F10452AF54165191D7B5AAA0DA54

Function 003DF7B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 003DF8E4
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 003DF8F1

Strings

Resume, xrefs: 003DF858
Failed to format pending restart registry key to read., xrefs: 003DF7E8
Failed to open registration key., xrefs: 003DF84D
Failed to read Resume value., xrefs: 003DF87A
%ls.RebootRequired, xrefs: 003DF7D1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: a5925d8ceb52e80994dbdc13bbd35d6e3da25508678923c358b27a125187de38
Instruction ID: 773a6bab0900af77a79eb5caea3fe017bd431c06dbd13685e7d7fea86f218a01
Opcode Fuzzy Hash: a5925d8ceb52e80994dbdc13bbd35d6e3da25508678923c358b27a125187de38
Instruction Fuzzy Hash: D5413073D00119EFDB129F94E981AADBBB4FF04314F158177E812AB351D3759E40AB52

Function 0040FDEF Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0043B5D4,00000000,?,?,?,003E4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,003D5537,?), ref: 0040FDFF
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,0043B5CC,?,003E4192,00000000,Setup), ref: 0040FEA3
GetLastError.KERNEL32(?,003E4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,003D5537,?,?,?), ref: 0040FEB3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,003E4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,003D5537,?), ref: 0040FEED

Part of subcall function 003D2EBC: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 003D3006

LeaveCriticalSection.KERNEL32(0043B5D4,?,?,0043B5CC,?,003E4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,003D5537,?), ref: 0040FF46

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0040FED2
7U=, xrefs: 0040FE1C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: 7U=$c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-1350941929
Opcode ID: 3b6206fa67311f90f811fa299ba8cb96145958019fa6e29895cabfa0a4dda583
Instruction ID: 7d301eb10c9006a13238ca270a8ccf299f02acecc33f3d98159c42044cdffe73
Opcode Fuzzy Hash: 3b6206fa67311f90f811fa299ba8cb96145958019fa6e29895cabfa0a4dda583
Instruction Fuzzy Hash: 4F31E63290021ABFDB329F60EC45B5B3A69EB04754F104137FA00BA6E1D779DD549BD8

Function 003F3727 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003F378E

Strings

%s%="%s", xrefs: 003F37C1
Failed to format property value., xrefs: 003F3817
Failed to escape string., xrefs: 003F3810
Failed to format property string part., xrefs: 003F3809
feclient.dll, xrefs: 003F3769, 003F378A
Failed to append property string part., xrefs: 003F3802

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.$feclient.dll
API String ID: 3613110473-656185529
Opcode ID: b4146c67be88865a01950f91dc5a89c2e48d76ff53b5a8fdae4b394ac2553b2e
Instruction ID: bad3cf4ebfac9b7b937d8c0907fc34d185cf181820528a93912c7db507ae1676
Opcode Fuzzy Hash: b4146c67be88865a01950f91dc5a89c2e48d76ff53b5a8fdae4b394ac2553b2e
Instruction Fuzzy Hash: C531AEB2D04229ABCB16AE54DC41AAEBB78EF00750F21412AFA0166251E774AF18DBD4

Function 003EA8DD Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

Failed to determine length of source path., xrefs: 003EA90D
Failed to trim source folder., xrefs: 003EA972
Failed to set last source., xrefs: 003EA9CD
WixBundleLastUsedSource, xrefs: 003EA97C, 003EA982, 003EA9BE
Failed to determine length of relative path., xrefs: 003EA92A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: cb7a671e383e396715f75bf5d7677a875cd832f62c77fe66801003f63f955604
Instruction ID: 8e6c9c44ee2c022056df09154a3641a1b6e92e8b065851e0bea35d0cc05c280f
Opcode Fuzzy Hash: cb7a671e383e396715f75bf5d7677a875cd832f62c77fe66801003f63f955604
Instruction Fuzzy Hash: 9D31D632D00679FBCB239A95DC41EAE7A79EB40730F224363F810BA2D2D770AD509691

Function 003FD572 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004301A0,00000000,00000017,004301B0,?,?,00000000,00000000,?,?,?,?,?,003FDB99,00000000,00000000), ref: 003FD5AA

Strings

WixBurn, xrefs: 003FD5D5
Failed to create IBackgroundCopyManager., xrefs: 003FD5B6
Failed to set progress timeout., xrefs: 003FD614
Failed to create BITS job., xrefs: 003FD5E4
Failed to set BITS job to foreground., xrefs: 003FD62B
Failed to set notification flags for BITS job., xrefs: 003FD5FC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: fbdebd7c56edb87c428909b1c2d93bead65d19798cc6b7e3b1a914093fcb2dc7
Instruction ID: e2d270fd2831dc7638b83bef14a064dfc29b651c08c80f235162c2526febb1c6
Opcode Fuzzy Hash: fbdebd7c56edb87c428909b1c2d93bead65d19798cc6b7e3b1a914093fcb2dc7
Instruction Fuzzy Hash: 8A31B631A40219AFDB16CB68C859E7FBBB9AF49714F204169FA05EB350C774EC05CB94

Function 0041559F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 004155E9
GetLastError.KERNEL32 ref: 004155F6
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 0041563D
GetLastError.KERNEL32 ref: 00415671
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 004156A5

Strings

%ls.R, xrefs: 004155BD
c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 0041561A, 00415695

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-260802336
Opcode ID: b66f938ae91ddab21937e13e61b67cc293a6bfd9a7cb8794482fb89dc0f4d50d
Instruction ID: bb0ea6a6a3b19da3c8a9cbc5d8104a1dafbe459eaeafb7e0befd5a3906af24bb
Opcode Fuzzy Hash: b66f938ae91ddab21937e13e61b67cc293a6bfd9a7cb8794482fb89dc0f4d50d
Instruction Fuzzy Hash: 0F314872A41621FBE7218F54DC44BEE7BA4AF85720F124216FE04EF2C0D3789C408AE9

Function 003DC8A5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003DCD19: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,003DE3ED,000000FF,00000000,00000000,003DE3ED,?,?,003DDB97,?,?,?,?), ref: 003DCD44

CreateFileW.KERNEL32(E90041AA,80000000,00000005,00000000,00000003,08000000,00000000,003D5402,?,00000000,840F01E8,E0680A79,00000001,003D53FA,00000000,003D54C6), ref: 003DC915
GetLastError.KERNEL32(?,?,?,003E76FC,003D56AA,003D54B6,003D54B6,00000000,?,003D54C6,FFF9E89D,003D54C6,003D54FA,003D5482,?,003D5482), ref: 003DC95A

Strings

Failed to verify catalog signature: %ls, xrefs: 003DC953
c:\agent\_work\66\s\src\burn\engine\catalog.cpp, xrefs: 003DC97B
Failed to find payload for catalog file., xrefs: 003DC99F
Failed to get catalog local file path, xrefs: 003DC998
Failed to open catalog in working path: %ls, xrefs: 003DC988

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$c:\agent\_work\66\s\src\burn\engine\catalog.cpp
API String ID: 1774366664-749786727
Opcode ID: 4f37014f8fd4be8dc986a1f8957214e9a71fede820c46995469599ee87bb2690
Instruction ID: 44ef981e1f95b9f523b35551be48bbf3b4dac4e32d3100ea7733eb96e9c83fe0
Opcode Fuzzy Hash: 4f37014f8fd4be8dc986a1f8957214e9a71fede820c46995469599ee87bb2690
Instruction Fuzzy Hash: 6331F173920622BFD7129B65DC11F9ABBA4AF04750F218227BD05BB381E774A950CB98

Function 00410201 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00410271
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 0041027B
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 004102C4
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 004102D1

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 0041029F
D, xrefs: 00410259
"%ls" %ls, xrefs: 0041023A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 161867955-1799623275
Opcode ID: cf989320b58354eb2b6104918db08810aabd6332e2c59e6821f041f7410c5d23
Instruction ID: 161920fc0debfa0b98b80a58b8265d659a91b50b27860ba10a2edfc6833b98b0
Opcode Fuzzy Hash: cf989320b58354eb2b6104918db08810aabd6332e2c59e6821f041f7410c5d23
Instruction Fuzzy Hash: 6A216172D0121AABDB11DFD4DD459EFBB78AF04310F104066EA00B6211E7B48E8086A5

Function 003FD016 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,003FD312,?), ref: 003FD035
ReleaseMutex.KERNEL32(?,?,?,003FD312,?), ref: 003FD049
WaitForSingleObject.KERNEL32(?,000000FF), ref: 003FD08E
ReleaseMutex.KERNEL32(?), ref: 003FD0A1
SetEvent.KERNEL32(?), ref: 003FD0AA

Strings

Failed to get message from netfx chainer., xrefs: 003FD0CB
Failed to send files in use message from netfx chainer., xrefs: 003FD0EE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: c2eb95ab4330b182012b2e0df0e25d8328fa8035b8baa8192366b06bd5fd2dce
Instruction ID: 94257e2955db8f0979a13efb5be3309f4ac139633a5a8c2c18eaf5b46a315ece
Opcode Fuzzy Hash: c2eb95ab4330b182012b2e0df0e25d8328fa8035b8baa8192366b06bd5fd2dce
Instruction Fuzzy Hash: 6D31C23290021ABFCB029F64DC48FFEBBB9BF05324F108266F510A6291CB74E9558B90

Function 003D9B5C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9B75
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,003DA880,00000100,000002C0,000002C0,00000100), ref: 003D9B95
GetLastError.KERNEL32(?,003DA880,00000100,000002C0,000002C0,00000100), ref: 003D9BA0

Strings

Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 003D9C0C
Failed while searching directory search: %ls, for path: %ls, xrefs: 003D9BF6
Failed to set directory search path variable., xrefs: 003D9BD1
Failed to format variable string., xrefs: 003D9B80

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: 18ef5447686d237c415026abaeb5908e99620b5f4e286463215b87c0da18bae0
Instruction ID: 7a9a26148ec2b670560ca0371e4872d63a2fd0d1c4ef3d7ab3bcd2e5ed4f6f95
Opcode Fuzzy Hash: 18ef5447686d237c415026abaeb5908e99620b5f4e286463215b87c0da18bae0
Instruction Fuzzy Hash: AF11F633C40125B7CB232A98BD02F9D7A659F00320F224263FC15776A1E7399D50A6D5

Function 003D9D11 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9D2A
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,003DA858,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 003D9D4A
GetLastError.KERNEL32(?,003DA858,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 003D9D55

Strings

Failed while searching file search: %ls, for path: %ls, xrefs: 003D9D83
Failed to set variable to file search path., xrefs: 003D9DAD
File search: %ls, did not find path: %ls, xrefs: 003D9DB9
Failed to format variable string., xrefs: 003D9D35

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 5201328739a674807f2a8f0e47876fdda32b1ca62762b0ef2e72210866249487
Instruction ID: 43b15e0eb9f5f4d3888dafc071cb1aa22fd9b92999e99ad66a22c3ec07809b0b
Opcode Fuzzy Hash: 5201328739a674807f2a8f0e47876fdda32b1ca62762b0ef2e72210866249487
Instruction Fuzzy Hash: 2311E433D40125BBCB236A94EC02B9DBA2AAF15724F214123FC00763A1D7359E50A6C5

Function 003D9A0E Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 003D9A85

Strings

Failed to get Condition inner text., xrefs: 003D9A55
`<u, xrefs: 003D9A85
Condition, xrefs: 003D9A20
Failed to copy condition string from BSTR, xrefs: 003D9A6F
Failed to select condition node., xrefs: 003D9A3C
BT=, xrefs: 003D9A0E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeString
String ID: BT=$Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`<u
API String ID: 3341692771-1302106170
Opcode ID: d31aae5384655968bf7d0f1cd34715185f9a9a2708b720fb246b828d68a23585
Instruction ID: 79356c12808ed9ee0632c49f8bd5e0272bf0c93b230c9fb08a282acfaafb6f72
Opcode Fuzzy Hash: d31aae5384655968bf7d0f1cd34715185f9a9a2708b720fb246b828d68a23585
Instruction Fuzzy Hash: DC118233940228BBDB12A7A0ED46BEE7B789F00710F210167F801B6350D7749E409684

Function 003ECDC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,003ED1EC,00000000,?,?,003EC672,?,?,?,?,?,003D54A3), ref: 003ECDDA
GetLastError.KERNEL32(?,?,003ED1EC,00000000,?,?,003EC672,?,?,?,?,?,003D54A3,?,?,?), ref: 003ECDE4
GetExitCodeThread.KERNEL32(?,?,?,?,003ED1EC,00000000,?,?,003EC672,?,?,?,?,?,003D54A3,?), ref: 003ECE20
GetLastError.KERNEL32(?,?,003ED1EC,00000000,?,?,003EC672,?,?,?,?,?,003D54A3,?,?,?), ref: 003ECE2A

Strings

c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 003ECE08, 003ECE4E
Failed to wait for cache thread to terminate., xrefs: 003ECE12
Failed to get cache thread exit code., xrefs: 003ECE58

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3686190907-1009398494
Opcode ID: 6a0bbfc611a450cac400bcc1cf99f594c3b2752429c6f387ac358c89aae8685e
Instruction ID: 57fef9145523fa097ed19212f488da0f4fc3f15477f551221751d5681cade21e
Opcode Fuzzy Hash: 6a0bbfc611a450cac400bcc1cf99f594c3b2752429c6f387ac358c89aae8685e
Instruction Fuzzy Hash: F4014973A5163163D62257559C06B8F7958BF04B91B434232BE00BA2C1E77CDD0081ED

Function 003E68AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,003E6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 003E68BB
GetLastError.KERNEL32(?,003E6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 003E68C5
GetExitCodeThread.KERNEL32(00000001,00000000,?,003E6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 003E6904
GetLastError.KERNEL32(?,003E6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 003E690E

Strings

Failed to wait for cache thread to terminate., xrefs: 003E68F6
Failed to get cache thread exit code., xrefs: 003E693F
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 003E68EC, 003E6935

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 3686190907-4004332966
Opcode ID: 4ea6d8213f83c2fb2fb854eac1542e70fe80a1edbaed97dd949361d0df388bed
Instruction ID: 17fe8ebcbc5453ebb3fe36182fdac596d1ef7efe0c8c3f36f52a60c0dbd28240
Opcode Fuzzy Hash: 4ea6d8213f83c2fb2fb854eac1542e70fe80a1edbaed97dd949361d0df388bed
Instruction Fuzzy Hash: 3E11A570740266FBE7019F61AD03B7E3AA8EB10794F608176B900E91D1EB3ACA109729

Function 003EAA79 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(003D54C6,000000FF,003D5482,003E76FC,003D53FA,00000000,?), ref: 003EAB6A
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,003D54C6,000000FF,003D5482,003E76FC,003D53FA,00000000,?), ref: 003EABAE

Part of subcall function 003E9158: _memcmp.LIBVCRUNTIME ref: 003E91E6
Part of subcall function 003E9158: _memcmp.LIBVCRUNTIME ref: 003E9220

Strings

Failed to get signer chain from authenticode certificate., xrefs: 003EABDC
Failed to get provider state from authenticode certificate., xrefs: 003EAB98
Failed authenticode verification of payload: %ls, xrefs: 003EAB4B
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003EAB40, 003EAB8E, 003EABD2
0, xrefs: 003EAAE6
Failed to verify expected payload against actual certificate chain., xrefs: 003EABF2

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: 0$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3510382728
Opcode ID: 3cd06fe93b94c122a206a326f625476c7e32a50c6d03a07277a974d36641aa75
Instruction ID: 8b9ebbf503e2adae72cffb6a8732c0c729d044cddec2af9be65b6929bc61c640
Opcode Fuzzy Hash: 3cd06fe93b94c122a206a326f625476c7e32a50c6d03a07277a974d36641aa75
Instruction Fuzzy Hash: A641C972D0167A9BDB12CF95DC05ADEBAB4AF04310F11022AF801BB3C0D778AD048BE5

Function 003EF618 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003EF62D
LeaveCriticalSection.KERNEL32(?), ref: 003EF73A

Strings

Failed to set source path for payload., xrefs: 003EF6C9
Engine is active, cannot change engine state., xrefs: 003EF647
UX requested unknown container with id: %ls, xrefs: 003EF6F9
UX requested unknown payload with id: %ls, xrefs: 003EF699
Failed to set source path for container., xrefs: 003EF71F
UX denied while trying to set source on embedded payload: %ls, xrefs: 003EF6AF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: 083fba165544d2fec8497298e39a3cf61700ae97625219e7147d3a819f50a74a
Instruction ID: cf19f2c0048b05112cac59c60b68d6de8d3013994860c738091abca5ab959293
Opcode Fuzzy Hash: 083fba165544d2fec8497298e39a3cf61700ae97625219e7147d3a819f50a74a
Instruction Fuzzy Hash: 3F311672A00271BFCB239B66DC45E5A77EC9F507A0B154277FC00EB380DAB4ED008694

Function 003D720A Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 003D721D

Strings

Failed to append escape sequence., xrefs: 003D72B0
[\%c], xrefs: 003D727C
Failed to append characters., xrefs: 003D72A9
Failed to allocate buffer for escaped string., xrefs: 003D7234
Failed to copy string., xrefs: 003D72D1
[]{}, xrefs: 003D7247
Failed to format escape sequence., xrefs: 003D72B7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: ce131cb696b476cabd057008db9f128c11325cb0211a797e3967b3ca67e76869
Instruction ID: 228c119ecc5a57cc43c5cefeded3127a74a97566a5e580e02044780cdcb7469e
Opcode Fuzzy Hash: ce131cb696b476cabd057008db9f128c11325cb0211a797e3967b3ca67e76869
Instruction Fuzzy Hash: B321B633D48255BBDB239694AC42FEF766C9B14764F310527F900B6381FB78AE409694

Function 003F5954 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,0041A500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,003F6548,?,00000001,?,00000000), ref: 003F59BD

Strings

Failed grow array of ordered patches., xrefs: 003F5A56
Failed to plan action for target product., xrefs: 003F5A68
Failed to copy target product code., xrefs: 003F5AEE
feclient.dll, xrefs: 003F59B3, 003F5ADB
Failed to insert execute action., xrefs: 003F5A12

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: f83be4e9dc546c208b6c25a569806cf47b405752d4552376afcbf48cdd8a4e41
Instruction ID: ce02ab8c72f4668c01446334156dfe0473a1d5e9752c6720c88925be3516d943
Opcode Fuzzy Hash: f83be4e9dc546c208b6c25a569806cf47b405752d4552376afcbf48cdd8a4e41
Instruction Fuzzy Hash: 888137B560075ADFCB1ACF54C880AAA77A5FF08324F12866AEE159B352D770EC21CF50

Function 0040C3AD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0040CB22,00000000,00000000,00000000,00000000,00000000,00402718), ref: 0040C3EF
__fassign.LIBCMT ref: 0040C46A
__fassign.LIBCMT ref: 0040C485
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0040C4AB
WriteFile.KERNEL32(?,00000000,00000000,0040CB22,00000000,?,?,?,?,?,?,?,?,?,0040CB22,00000000), ref: 0040C4CA
WriteFile.KERNEL32(?,00000000,00000001,0040CB22,00000000,?,?,?,?,?,?,?,?,?,0040CB22,00000000), ref: 0040C503

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4bd6ea5ad58981d00dc987437fc258cb44d7137ad4293b907e74dc30e8a67381
Instruction ID: ba1ffa7314b8cb3f8b2e627c9306c3321d226bc074120afc6c2dbe39919026df
Opcode Fuzzy Hash: 4bd6ea5ad58981d00dc987437fc258cb44d7137ad4293b907e74dc30e8a67381
Instruction Fuzzy Hash: 9351B175900219EFCB10CFA8DC85AEEBBF4EF09304F14422AE951F7291E734A941CB65

Function 003F8FA9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,003E700A,000000B8,0000001C,00000100), ref: 003F8FD4
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,0041A4B8,000000FF,?,?,?,003E700A,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 003F905E

Strings

Failed to initialize update bundle., xrefs: 003F9101
comres.dll, xrefs: 003F90E0
BA aborted detect forward compatible bundle., xrefs: 003F90C8
c:\agent\_work\66\s\src\burn\engine\detect.cpp, xrefs: 003F90BE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$c:\agent\_work\66\s\src\burn\engine\detect.cpp$comres.dll
API String ID: 1825529933-4215571375
Opcode ID: df088f7d34ca56aaa9a4dad53447317134ae89b71d406bf9bc2bef1bb86ca72f
Instruction ID: c12db6ec3fd0b708744e85e46c8e4dc1399729515c674fc1c27b93326a05db8e
Opcode Fuzzy Hash: df088f7d34ca56aaa9a4dad53447317134ae89b71d406bf9bc2bef1bb86ca72f
Instruction Fuzzy Hash: 0E51C57160021AFBDF169F64CC85FBAB76AFF05310F11426AFA149A1A1C772EC60DB90

Function 003ED2BA Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,0041A500,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,003E73D9), ref: 003ED3E3

Strings

Failed to connect to elevated child process., xrefs: 003ED3CC
Failed to create pipe and cache pipe., xrefs: 003ED340
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 003ED2EE
Failed to elevate., xrefs: 003ED3C5
UX aborted elevation requirement., xrefs: 003ED2F8
Failed to create pipe name and client token., xrefs: 003ED324

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 2962429428-2367031576
Opcode ID: 8c9e13fd708652522829275ea2acb65ba88da6f37337ee39cc70d0d9241a52d6
Instruction ID: 8570242e426fbdb06772100be51f174d4020f5a02809264f28a6a09907c046df
Opcode Fuzzy Hash: 8c9e13fd708652522829275ea2acb65ba88da6f37337ee39cc70d0d9241a52d6
Instruction Fuzzy Hash: 40316077B40771BBEB139661EC42FAA765CEF00720F210316F915BE2C1DA65ED0086E6

Function 00418C74 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

RegCloseKey.ADVAPI32(00000001,00000001,crypt32.dll,00000000,00000001,0041A500,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00418D4C
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,crypt32.dll,00000000,00000001,0041A500,00000000,00000001,00000000,00020019), ref: 00418D87
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00418DA3
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00418DB0
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00418DBD

Part of subcall function 00410886: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00418D39,00000001), ref: 0041089E

Strings

crypt32.dll, xrefs: 00418D30

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID: crypt32.dll
API String ID: 796878624-1661610138
Opcode ID: 62571f4bf98e2f556e6fc68ac6bf8805cbffaee16867c9a24299851b77b96c49
Instruction ID: ee9b93fe6c63cabd71ecc59ca5bfbf6678aefb328f2798a522cfaa87221d9792
Opcode Fuzzy Hash: 62571f4bf98e2f556e6fc68ac6bf8805cbffaee16867c9a24299851b77b96c49
Instruction Fuzzy Hash: C1415872C0022CFFCF11AF949C819EEFA79AF14354F52416EEA0076260C7758E909B94

Function 003ED0E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,003EAC12,00000001,00000000,00000000), ref: 003ED170
GetLastError.KERNEL32(?,?,?,003D54A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003ED17C

Part of subcall function 003ECDC8: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,003ED1EC,00000000,?,?,003EC672,?,?,?,?,?,003D54A3), ref: 003ECDDA
Part of subcall function 003ECDC8: GetLastError.KERNEL32(?,?,003ED1EC,00000000,?,?,003EC672,?,?,?,?,?,003D54A3,?,?,?), ref: 003ECDE4

CloseHandle.KERNEL32(00000000,00000000,?,?,003EC672,?,?,?,?,?,003D54A3,?,?,?,?), ref: 003ED1FD

Strings

Failed to pump messages in child process., xrefs: 003ED1D4
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 003ED1A0
Failed to create elevated cache thread., xrefs: 003ED1AA

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3606931770-2334070456
Opcode ID: de832e29001a60aafd0fbfbeca5699fb0aa1472c67534f3209064fa63c9a9324
Instruction ID: 431ab9752ca516c2215743ac5a98860b8605ad490d5dc151c7f1ce0355445654
Opcode Fuzzy Hash: de832e29001a60aafd0fbfbeca5699fb0aa1472c67534f3209064fa63c9a9324
Instruction Fuzzy Hash: 1541D5B6D01269AFCB45DFA9D8819DEBBF4BF08710B11812AF805E7340E774A9418F94

Function 004171DB Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

SysFreeString.OLEAUT32(00000000), ref: 004172BE
SysFreeString.OLEAUT32(?), ref: 004172C9
SysFreeString.OLEAUT32(00000000), ref: 004172D4

Strings

sA, xrefs: 00417284, 004172D1, 00417272, 00417296
`<u, xrefs: 004172B3
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00417208

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$sA
API String ID: 2724874077-1578282342
Opcode ID: 2297543db2cbc36a087fd60eeca0dc7b846ffe869704163df2dd8db71d57e1ec
Instruction ID: 682e8b5f49b2e383fa5451e6c2846f42732831c647829108b353683dbb7901b1
Opcode Fuzzy Hash: 2297543db2cbc36a087fd60eeca0dc7b846ffe869704163df2dd8db71d57e1ec
Instruction Fuzzy Hash: 4231F932D0422ABBDB229B95CC45FDEBB78AF40710F114196F904BB240D778DE46CB94

Function 003D7337 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,003D5966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 003D7349
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,003D5966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 003D7428

Strings

Failed to get value as string for variable: %ls, xrefs: 003D7417
Failed to get variable: %ls, xrefs: 003D738A
Failed to format value '%ls' of variable: %ls, xrefs: 003D73F2
Failed to get unformatted string., xrefs: 003D73B9
*****, xrefs: 003D73E4, 003D73F1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: b4bbb2143a9e4937c1c25ce1e74027f91d70afef8e497365941904c7d89e4ec0
Instruction ID: 903772c82aa73c8032259ec336ea5445d841068f946c01715fa10e74d5312b06
Opcode Fuzzy Hash: b4bbb2143a9e4937c1c25ce1e74027f91d70afef8e497365941904c7d89e4ec0
Instruction Fuzzy Hash: 8A31DF33904619BBCF235E61DC06B9EBA74EB00329F114167FC00AA690E375AAA1DBC4

Function 00412B5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(0041A594), ref: 00412B73
SysAllocString.OLEAUT32(?), ref: 00412B8F
VariantClear.OLEAUT32(?), ref: 00412C16
SysFreeString.OLEAUT32(00000000), ref: 00412C21

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00412BA6
`<u, xrefs: 00412C21

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-1301604586
Opcode ID: ed727d9c1f1d8dd3fecf1016cd9f7791e572207a2c696d2fac8a9dc845837211
Instruction ID: 7b6b4d2379e5df7c436a18432a6bfa8310d862e4a72817d45ad9e48a9a785593
Opcode Fuzzy Hash: ed727d9c1f1d8dd3fecf1016cd9f7791e572207a2c696d2fac8a9dc845837211
Instruction Fuzzy Hash: 4C21D036901129AFCB11DF54CA48EEEBBB8AF44711F104069F911EB210DB74ED919B98

Function 00415100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,003F6879,00000000,?), ref: 00415116
GetLastError.KERNEL32(?,?,003F6879,00000000,?,?,?,?,?,?,?,?,?,003F6C89,?,?), ref: 00415124

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,003F6879,00000000,?), ref: 0041515E
GetLastError.KERNEL32(?,?,003F6879,00000000,?,?,?,?,?,?,?,?,?,003F6C89,?,?), ref: 00415168

Strings

yh?, xrefs: 004151B6
c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp, xrefs: 00415147, 00415189

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp$yh?
API String ID: 355237494-2290092731
Opcode ID: c369144b876957b76620e7ba86963eff47eb5b0680ee843d5c9131d703407964
Instruction ID: 5f1d94d1b8fc93981da4b875137594aec18f9b05525660a7077ec80ef1d7accb
Opcode Fuzzy Hash: c369144b876957b76620e7ba86963eff47eb5b0680ee843d5c9131d703407964
Instruction Fuzzy Hash: 81210137D01935F7D7239A858D05BDBA9699FC1BA0F164017BD00AB300E6B88E4096EE

Function 003E8CC3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,?,?,00000000,00000000,?,?,?), ref: 003E8D0E
GetLastError.KERNEL32 ref: 003E8D18
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 003E8D78

Strings

c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E8D3C
Failed to initialize ACL., xrefs: 003E8D46
Failed to allocate administrator SID., xrefs: 003E8CF4

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 669721577-4043978521
Opcode ID: 642370564abf18226aa706c73db3c193118bede5a0946f25b3ef34884e4a96cb
Instruction ID: 4d1d6fff3512583ac1832da03475c9cdbdaedbbd2250f1969a003c688fe6a830
Opcode Fuzzy Hash: 642370564abf18226aa706c73db3c193118bede5a0946f25b3ef34884e4a96cb
Instruction Fuzzy Hash: 5F210832E41264B7DB225BD69C45FDFB669AF10B50F118126B904FB2C0EA749D004694

Function 003D4263 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,003E3FAF,00000001,feclient.dll,?,00000000,?,?,?,003D4B57), ref: 003D429E
GetLastError.KERNEL32(?,?,003E3FAF,00000001,feclient.dll,?,00000000,?,?,?,003D4B57,?,?,0041A488,?,00000001), ref: 003D42AA
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,003E3FAF,00000001,feclient.dll,?,00000000,?,?,?,003D4B57,?), ref: 003D42E5
GetLastError.KERNEL32(?,?,003E3FAF,00000001,feclient.dll,?,00000000,?,?,?,003D4B57,?,?,0041A488,?,00000001), ref: 003D42EF

Strings

crypt32.dll, xrefs: 003D4267
c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 003D4313

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp$crypt32.dll
API String ID: 152501406-3173697099
Opcode ID: 493d30a4fe1929313fa5c857702da22d6e17b046f494cbdc18739d976c91ef78
Instruction ID: 38bd077dfdae1f7766b451609da1801a2efdba70e1d92bc90b4d8f749aaca43c
Opcode Fuzzy Hash: 493d30a4fe1929313fa5c857702da22d6e17b046f494cbdc18739d976c91ef78
Instruction Fuzzy Hash: 4B11D677E01636ABD7235AD96844AAFBA589F05754B124537FD00FB300E734DC208AE4

Function 003F0937 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 003F0987
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 003F09A6
GetLastError.KERNEL32 ref: 003F09B0

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F09D4
Failed to write during cabinet extraction., xrefs: 003F09DE
Unexpected call to CabWrite()., xrefs: 003F096A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1970631241-3210721340
Opcode ID: b22cd1df0ad85aff07eec43f46f12b91ef6a4ba44bcccf70ff164e9723442c3f
Instruction ID: 94c9c5e45c3022326a255c6f8d95c4ad303c6fb6f4f7c6b2bab7a2cbb1e22d17
Opcode Fuzzy Hash: b22cd1df0ad85aff07eec43f46f12b91ef6a4ba44bcccf70ff164e9723442c3f
Instruction Fuzzy Hash: 1F210177600109ABDB06CF6DD981DAA3BA9EF84324B114069FF04D7267E7B5DD00CB24

Function 003D9A9F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9AB8
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,003DA889,00000100,000002C0,000002C0,00000100), ref: 003D9ACD
GetLastError.KERNEL32(?,003DA889,00000100,000002C0,000002C0,00000100), ref: 003D9ADA

Strings

Failed while searching directory search: %ls, for path: %ls, xrefs: 003D9B1A
Failed to set variable., xrefs: 003D9B3F
Failed to format variable string., xrefs: 003D9AC3

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: b6510a31142fce76878836ad4e089854898abb6e321939518de5d31dbfe330d8
Instruction ID: c5f8027c474995526c190248fd9f63498304dd257061a02eec0574fd9acdfdbe
Opcode Fuzzy Hash: b6510a31142fce76878836ad4e089854898abb6e321939518de5d31dbfe330d8
Instruction Fuzzy Hash: 15110A33A40421BBCB236A64FC02FAE7669AF01320F234227FC11B6391D7759D50A6D5

Function 00412AB1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0041A4E8), ref: 00412AC4
VariantInit.OLEAUT32(?), ref: 00412AD0
VariantClear.OLEAUT32(?), ref: 00412B44
SysFreeString.OLEAUT32(00000000), ref: 00412B4F

Part of subcall function 00412CFC: SysAllocString.OLEAUT32(?), ref: 00412D11

Strings

`<u, xrefs: 00412B4F
msasn1.dll, xrefs: 00412AC0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `<u$msasn1.dll
API String ID: 347726874-267575571
Opcode ID: 4cb2c62b34525fe674881e74611c07d268074d352542e4861468a9a3f7a076d0
Instruction ID: 3a728fbb38a3c9279e5a4d75333687aa6cbd48c07dbbd22426daabfa0a499a4d
Opcode Fuzzy Hash: 4cb2c62b34525fe674881e74611c07d268074d352542e4861468a9a3f7a076d0
Instruction Fuzzy Hash: FC217C31A05219AFCB15DFA4CA48EEFBBB8BF44715F0041A9E901DB220D774EE51CB94

Function 003F09FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 003F0A6B
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003F0A7D
SetFileTime.KERNEL32(?,?,?,?), ref: 003F0A90
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,003F0660,?,?), ref: 003F0A9F

Strings

Invalid operation for this state., xrefs: 003F0A44
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F0A3A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 609741386-2444813713
Opcode ID: 02f3a3e70ff991b6d2054e163cf102540dbd60f97768612ce0964c6445b51a8d
Instruction ID: af019ab926a4bde29e79d2d1c2c07b077fe4cfffdc1ae583152454326ca452da
Opcode Fuzzy Hash: 02f3a3e70ff991b6d2054e163cf102540dbd60f97768612ce0964c6445b51a8d
Instruction Fuzzy Hash: 1B21C07291061EEE8B159FACDC088FABBBCFE44720B158226F951E66D1D374E910CB90

Function 004089AF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00408973: _free.LIBCMT ref: 0040899C

_free.LIBCMT ref: 004089FD

Part of subcall function 00405CE8: HeapFree.KERNEL32(00000000,00000000,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?), ref: 00405CFE
Part of subcall function 00405CE8: GetLastError.KERNEL32(?,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?,?), ref: 00405D10

_free.LIBCMT ref: 00408A08
_free.LIBCMT ref: 00408A13
_free.LIBCMT ref: 00408A67
_free.LIBCMT ref: 00408A72
_free.LIBCMT ref: 00408A7D
_free.LIBCMT ref: 00408A88

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction ID: 19fca8bb9fe275d8e94616f93753e0bfbb89a81b730c6d047c138b47ae3520fd
Opcode Fuzzy Hash: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction Fuzzy Hash: F61112B1544B04A6D520BBB2CD07FDB77DCAF04704F80483FB2D9761D2DA79B504AA59

Function 003E45CE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

_memcpy_s.LIBCMT ref: 003E461F
_memcpy_s.LIBCMT ref: 003E4632
_memcpy_s.LIBCMT ref: 003E464D

Strings

c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E45FE
crypt32.dll, xrefs: 003E4629, 003E4648
Failed to allocate memory for message., xrefs: 003E4608

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 886498622-1118502555
Opcode ID: 3dbfb678e0cdf83dd70d8d9ac56c48ecf0a35ab08304b3fcc419dfd9fdc2b754
Instruction ID: 04418c7aff6f21e3afd362a17c55437fdba11154edce08e4cb2e587289010b55
Opcode Fuzzy Hash: 3dbfb678e0cdf83dd70d8d9ac56c48ecf0a35ab08304b3fcc419dfd9fdc2b754
Instruction Fuzzy Hash: F1118FB360021ABBDB02DE90DC82DEB73ACAF05715B004527BE10DB241E775DA1487E1

Function 004134C7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0041351B
GetLastError.KERNEL32 ref: 00413525
CloseHandle.KERNEL32(?), ref: 00413558

Strings

c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp, xrefs: 00413546
PDu, xrefs: 0041351B
<, xrefs: 0041350D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDu$c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-2506374349
Opcode ID: 7d67dbec9ef1a4a46d933686b9f00583a7c7056e4ba7fa0bc51a467ff1f3656c
Instruction ID: cb2168aa26239665da2e4cfa5cbca844da340a87e11c6f92474d63801487542e
Opcode Fuzzy Hash: 7d67dbec9ef1a4a46d933686b9f00583a7c7056e4ba7fa0bc51a467ff1f3656c
Instruction Fuzzy Hash: 6521B7B5E01229ABCB10CF99D944ADEBBF8BF08B51F10811AF915E7340E3749A408F95

Function 004102EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,003D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 004102F8
GetLastError.KERNEL32(?,003D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00410306
GetExitCodeProcess.KERNEL32(000000FF,?), ref: 0041034B
GetLastError.KERNEL32(?,003D4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00410355

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 0041032A
]O=, xrefs: 0041037B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: ]O=$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 590199018-3881358076
Opcode ID: d9ab109e17a9a9c554f98cd174dd6c2967982db6cf51fcf0c79692479edacbfc
Instruction ID: 6c195085ffcc3134a5f5a532b34b1d6f3724de0c156fd2f574187dfcee6f7147
Opcode Fuzzy Hash: d9ab109e17a9a9c554f98cd174dd6c2967982db6cf51fcf0c79692479edacbfc
Instruction Fuzzy Hash: A0018E3694113AA7C7215A9098086DA7A94AB08760F128222FD64AF350D2B98CD09AD9

Function 0041038A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,003D5EE0,00000000), ref: 0041039E
GetProcAddress.KERNEL32(00000000), ref: 004103A5
GetLastError.KERNEL32(?,?,?,003D5EE0,00000000), ref: 004103BC

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 004103DD
kernel32, xrefs: 00410396
IsWow64Process, xrefs: 0041038F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-3797636953
Opcode ID: cfa12589f77ef68bcde1153148b40184b9bdac7226ba7bd505bc99c4a2446253
Instruction ID: 3ad989c31c7942f9ba6eec2aba4397ffe9aaf59fb66ab5299cecfbee8bd063af
Opcode Fuzzy Hash: cfa12589f77ef68bcde1153148b40184b9bdac7226ba7bd505bc99c4a2446253
Instruction Fuzzy Hash: A3F02232A0123AAB87218B959D09ACF7E24EF04750B018112FD14FB240E6F8DE8087D9

Function 00404189 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0040413A,00000000,?,004040DA,00000000,00437908,0000000C,00404231,00000000,00000002), ref: 004041A9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004041BC
FreeLibrary.KERNEL32(00000000,?,?,?,0040413A,00000000,?,004040DA,00000000,00437908,0000000C,00404231,00000000,00000002), ref: 004041DF

Strings

CorExitProcess, xrefs: 004041B4
mscoree.dll, xrefs: 004041A2
8?, xrefs: 004041CD

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 8?$CorExitProcess$mscoree.dll
API String ID: 4061214504-2228539323
Opcode ID: 01cc9a9902c5ba4342a740ad5755027037132efe05cb08e8341eafac43722e26
Instruction ID: 9dbb56f8b5caf5afc48c8b9bc60b7ed67b75934ff0ea30e8a5a0f045aaa12fe5
Opcode Fuzzy Hash: 01cc9a9902c5ba4342a740ad5755027037132efe05cb08e8341eafac43722e26
Instruction Fuzzy Hash: 13F0C871A01208BBCB119F90DC0DBEEBFB5EF48751F004175FD05A6290DB344E94CA49

Function 003E8B85 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 003E8BF1

Strings

Failed to get old %hs package cache root directory., xrefs: 003E8C91
Failed to calculate cache path., xrefs: 003E8BAE
per-user, xrefs: 003E8C4B, 003E8C50, 003E8C8B, 003E8C90
per-machine, xrefs: 003E8C42, 003E8C82
Failed to get %hs package cache root directory., xrefs: 003E8C51

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: 6bdd9ab535eea65d287bbe89c1feeb77e8012988c4a5424ebb7a7187727cafc1
Instruction ID: c701b75720d4f92730c0a9175b23c8cf056912b361fe81143db4f5a7f7e77726
Opcode Fuzzy Hash: 6bdd9ab535eea65d287bbe89c1feeb77e8012988c4a5424ebb7a7187727cafc1
Instruction Fuzzy Hash: 94313772E41275BFEB13A7669D46FBFA26C9B01710F210262FD08FA282DA74DD0056B5

Function 003EE7A7 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 003EE7D6
SetWindowLongW.USER32(?,000000EB,00000000), ref: 003EE7E5
SetWindowLongW.USER32(?,000000EB,?), ref: 003EE7F9
DefWindowProcW.USER32(?,?,?,?), ref: 003EE809
GetWindowLongW.USER32(?,000000EB), ref: 003EE823
PostQuitMessage.USER32(00000000), ref: 003EE882

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: cbe5111e0c09f9c51024812cbe8b15107cf23ccf9a87851bfcb10afa01139313
Instruction ID: b53c44693502f7e3454481e4a2e92efeebc848d4d674e1aec6453e58a8f036c7
Opcode Fuzzy Hash: cbe5111e0c09f9c51024812cbe8b15107cf23ccf9a87851bfcb10afa01139313
Instruction Fuzzy Hash: 7D218132104168AFDB065F68DC49EAA3F69FF45720F148724FD1A9A1E1C631DD20DB55

Function 00405929 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,004012E7,00000000,80004004,?,004015EB,00000000,80004004,00000000,00000000), ref: 0040592D
_free.LIBCMT ref: 00405960
_free.LIBCMT ref: 00405988
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00405995
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 004059A1
_abort.LIBCMT ref: 004059A7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 456a3c6edf7f9e7c06a99c6734948611f3652930e6d010612af9f9ba94efb6e9
Instruction ID: e27b6361ab28d454d77a2260104de7f98ed27874d8d812a06ab596f97f17444f
Opcode Fuzzy Hash: 456a3c6edf7f9e7c06a99c6734948611f3652930e6d010612af9f9ba94efb6e9
Instruction Fuzzy Hash: F9F0F471285E01A7D61227366C0AF5B2529DBC1738B25403FF418F23E1EF3C8802496E

Function 003EC672 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 003EC6BA
CloseHandle.KERNEL32(?), ref: 003EC6C2

Strings

c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 003EC861
Failed to save state., xrefs: 003EC73A
Unexpected elevated message sent to child process, msg: %u, xrefs: 003EC86D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 4207627910-1654385460
Opcode ID: 46e42e8da79611a4bd317ce701267de6d5fabf134d64a29f31f06143bf9cee2e
Instruction ID: c7d650b2921e0402b51b7ef0c7829067b3d5bb59313873c5088e179fe9b98f1b
Opcode Fuzzy Hash: 46e42e8da79611a4bd317ce701267de6d5fabf134d64a29f31f06143bf9cee2e
Instruction Fuzzy Hash: D161B97A110560EFCB135F85CE01C9ABBB6FF08710715C669FA6A5A672C732E821EF41

Function 004172DE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

SysFreeString.OLEAUT32(00000000), ref: 0041743B
SysFreeString.OLEAUT32(00000000), ref: 00417446
SysFreeString.OLEAUT32(00000000), ref: 00417451

Strings

`<u, xrefs: 00417430
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00417311

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-3052637621
Opcode ID: 4710980054ac2b30bcc4605a667f7c0a929df9df21fad9220ce55a7ec6cbc30a
Instruction ID: 3c450bfc40f2db2d80b50d374fd7a7f1031f670e4053bad9d0d30c5b654e0df2
Opcode Fuzzy Hash: 4710980054ac2b30bcc4605a667f7c0a929df9df21fad9220ce55a7ec6cbc30a
Instruction Fuzzy Hash: 0651A432A0422AAFDB11DF65C844EEFBBB8AF04714F11419AF911AB250D774EE44CBE4

Function 00410AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00410ADC
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,003E6FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 00410B13
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00410C05

Strings

BundleUpgradeCode, xrefs: 00410ABB
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00410B56

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-1890108899
Opcode ID: 6593a5b650274a27938644921d85f8b9991424110e632348ae6f8023c96db31d
Instruction ID: 97b78d6fee12d691e6e310e5e63b351005db9a9f1d865564eaea0d3b3b62b486
Opcode Fuzzy Hash: 6593a5b650274a27938644921d85f8b9991424110e632348ae6f8023c96db31d
Instruction Fuzzy Hash: 1C41A371A0011AEBCB259F94D941AEFB7A9EF04714F11416BF901AB311D6B8ADC1CFA8

Function 00415B40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041412E: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,003E8651,00000000,00000000,00000000,00000000,00000000), ref: 00414146
Part of subcall function 0041412E: GetLastError.KERNEL32(?,?,?,003E8651,00000000,00000000,00000000,00000000,00000000), ref: 00414150

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,004153FE,?,?,?,?,?,?,?,00010000,?), ref: 00415BA9
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,004153FE,?,?,?,?), ref: 00415BFB
GetLastError.KERNEL32(?,004153FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00415C41
GetLastError.KERNEL32(?,004153FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00415C67

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00415C8B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 133221148-16760509
Opcode ID: 5351a2202cd556032794ef9a39be9bf28d260070c2fd4b8f27d0dfe6927564a2
Instruction ID: d5b41877b930ca329e94cb84cd5cd4b1a6a9ae6fb03322d13cd27c222d1fcd69
Opcode Fuzzy Hash: 5351a2202cd556032794ef9a39be9bf28d260070c2fd4b8f27d0dfe6927564a2
Instruction Fuzzy Hash: 2D417F7250071AFFDB218E94CD44BEA7B68EF44355F154126FD10A6190E378DDA0DBE8

Function 003D252E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,0040F8C7,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040F8C7,003F1074,?,00000000), ref: 003D2574
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,0040F8C7,003F1074,?,00000000,0000FDE9,?,003F1074), ref: 003D2580

Part of subcall function 003D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,003D22D5,000001C7,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3C67
Part of subcall function 003D3C5F: HeapSize.KERNEL32(00000000,?,003D22D5,000001C7,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 003D25A4

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: 7c1628a45ffdcdf9253038a8959cd223f6dcab9337f00490f28588fd1c1f005e
Instruction ID: 7cc8df41f3555f5d4796cba1a4a036c590b060976e72fffb77fd4960007b71b2
Opcode Fuzzy Hash: 7c1628a45ffdcdf9253038a8959cd223f6dcab9337f00490f28588fd1c1f005e
Instruction Fuzzy Hash: E731D372200316AFE7129E64BC90E77769EAB65368B11422BFD119B390EBB1CC109761

Function 00408AD8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,BCE85006,00401C3F,00000000,00000000,00402C74,?,t,@,?,00000001,00401C3F,BCE85006,00000001,00402C74,00402C74), ref: 00408B25
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00408BAE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00408BC0
__freea.LIBCMT ref: 00408BC9

Part of subcall function 00405D22: HeapAlloc.KERNEL32(00000000,?,?,?,00401782,?,0000015D,?,?,?,?,00402BDB,000000FF,00000000,?,?), ref: 00405D54

Strings

t,@, xrefs: 00408AEB

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID: t,@
API String ID: 573072132-3813946272
Opcode ID: 38c131afb2ee5dd835347b41fb297ee342dc8772eff44880f010f99b45d13698
Instruction ID: 42fe67efb5e016120f734c0d76de226ef5f630006c62aa842ca56eda2ae5f61a
Opcode Fuzzy Hash: 38c131afb2ee5dd835347b41fb297ee342dc8772eff44880f010f99b45d13698
Instruction Fuzzy Hash: C131DCB2A0021AABDB259F65DC45DAF3BB5EB00310B04417EFC54E6290EB39EC90CB94

Function 00413A14 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00413B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,003E9F39,00000001), ref: 00413A32
GetLastError.KERNEL32(00000002,?,00413B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,003E9F39,00000001,000007D0,00000001,00000001,00000003), ref: 00413A41
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,00413B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,003E9F39,00000001), ref: 00413ADA
GetLastError.KERNEL32(?,00413B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,003E9F39,00000001,000007D0,00000001,00000001,00000003,000007D0), ref: 00413AE4

Part of subcall function 00413C72: FindFirstFileW.KERNEL32(003F8F6B,?,00000100,00000000,00000000), ref: 00413CAD
Part of subcall function 00413C72: FindClose.KERNEL32(00000000), ref: 00413CB9

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00413B03

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3479031965-1688708105
Opcode ID: 7fea6677b98a41e057e166cf215a1e65933ea9359221ab3dc2e9dacf53960681
Instruction ID: a33652c1912538155eebe3e153ddda5ebec2e7c772c13a881d927daac5fda91a
Opcode Fuzzy Hash: 7fea6677b98a41e057e166cf215a1e65933ea9359221ab3dc2e9dacf53960681
Instruction Fuzzy Hash: 46312633A44222A7DB218E589C01AFB7755EF407A2F164127FC44AB352E378AEC1C2DD

Function 003FAA41 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 003FAAB0

Strings

Failed to extract payload: %ls from container: %ls, xrefs: 003FAB39
Failed to open container: %ls., xrefs: 003FAA82
Failed to extract all payloads from container: %ls, xrefs: 003FAAF4
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 003FAB45

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: 60e03cb5c7a3aef94d7b544c7bee67bd031f16e1382247356840d2d4fe232365
Instruction ID: 32962dc10b03773c14913629ff6ded621d93de0e9a356d91b4253b9473555b66
Opcode Fuzzy Hash: 60e03cb5c7a3aef94d7b544c7bee67bd031f16e1382247356840d2d4fe232365
Instruction Fuzzy Hash: D831D672D0051ABBCF13DAE4DD42E9E7779AF04710F214122FE15AA191E7349E18DBA1

Function 00413B71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00413C72: FindFirstFileW.KERNEL32(003F8F6B,?,00000100,00000000,00000000), ref: 00413CAD
Part of subcall function 00413C72: FindClose.KERNEL32(00000000), ref: 00413CB9

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00413C64

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

Part of subcall function 00410AB4: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00410ADC
Part of subcall function 00410AB4: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,003E6FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 00410B13

Strings

crypt32.dll, xrefs: 00413B9C
\, xrefs: 00413BED
PendingFileRenameOperations, xrefs: 00413BCF
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00413BA3

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: ddf279facf04f77d314641fa0de4af77b5bef8fc9e78d7d7b9a5d2bdba8cf834
Instruction ID: 25a2fa950a8ffc335e38c4519ebc1920d27d970155ae8f0e5190ff9db6127bea
Opcode Fuzzy Hash: ddf279facf04f77d314641fa0de4af77b5bef8fc9e78d7d7b9a5d2bdba8cf834
Instruction Fuzzy Hash: 8631B332900219FADF21AF84CD419EFBB75EF14752F14806BE501B6251E3399BC0CB98

Function 003DEFB7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,003E05EB,00000001,00000001,00000001,003E05EB,00000000), ref: 003DF02F
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,003E05EB,00000001,00000001,00000001,003E05EB,00000000,00000001,00000000,?,003E05EB,00000001), ref: 003DF04C

Strings

Failed to format key for update registration., xrefs: 003DEFE5
PackageVersion, xrefs: 003DF010
Failed to remove update registration key: %ls, xrefs: 003DF077

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 58a1de4e1b7fa900e38f707414eaaecca6fb929a49bbdbfdde9f37dc6fdd72db
Instruction ID: 28d2d240b3ef049a457a365e147f8a778f53655a539666940b8e55ae4b88f55e
Opcode Fuzzy Hash: 58a1de4e1b7fa900e38f707414eaaecca6fb929a49bbdbfdde9f37dc6fdd72db
Instruction Fuzzy Hash: 2121D772D00125BECB22ABA5ED45FAEBFB8DF04764F104177B801B7292E7749A40C694

Function 00413843 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,003D4DFD,00000000,?,?,00000000,?,0041395E,00000000,003D4DFD,00000000,00000000,?,003E84D1,?,?), ref: 0041385D
GetLastError.KERNEL32(?,0041395E,00000000,003D4DFD,00000000,00000000,?,003E84D1,?,?,00000001,00000003,000007D0,?,?,?), ref: 0041386B
CopyFileW.KERNEL32(00000000,003D4DFD,00000000,003D4DFD,00000000,?,0041395E,00000000,003D4DFD,00000000,00000000,?,003E84D1,?,?,00000001), ref: 004138DD
GetLastError.KERNEL32(?,0041395E,00000000,003D4DFD,00000000,00000000,?,003E84D1,?,?,00000001,00000003,000007D0,?,?,?), ref: 004138E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00413906

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 374144340-1688708105
Opcode ID: 7aea635e52f477056b61f2b726c1054e7649a9192d7e6dd17c060f242a08d585
Instruction ID: 69a72f8534100336930e3ba60c3a44729a09e8219d49f3853531aed3e36d3f33
Opcode Fuzzy Hash: 7aea635e52f477056b61f2b726c1054e7649a9192d7e6dd17c060f242a08d585
Instruction Fuzzy Hash: FB213B77A1062297AB215F954C00BF76798EF54762B114027FD08DB310EAACCE8152D9

Function 003DEECF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003DEF0A

Part of subcall function 00413984: SetFileAttributesW.KERNEL32(003F8F6B,00000080,00000000,003F8F6B,000000FF,00000000,?,?,003F8F6B), ref: 004139B3
Part of subcall function 00413984: GetLastError.KERNEL32(?,?,003F8F6B), ref: 004139BD

Part of subcall function 003D3CF7: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,003DEF55,00000001,00000000,00000095,00000001,003E05FA,00000095,00000000,swidtag,00000001), ref: 003D3D14

Strings

Failed to allocate regid folder path., xrefs: 003DEF70
swidtag, xrefs: 003DEF19
Failed to format tag folder path., xrefs: 003DEF77
Failed to allocate regid file path., xrefs: 003DEF69

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: 66a2a470145c8146a360b6f00fda8122e10fd8effcf6511e45096985e3bdea11
Instruction ID: 57f1c3c57861e108f548fb21234e420958aa6302190f498efdd16cdd7d20eaae
Opcode Fuzzy Hash: 66a2a470145c8146a360b6f00fda8122e10fd8effcf6511e45096985e3bdea11
Instruction Fuzzy Hash: FD214C32D00228FBCB16EB99EC41A9DBBB9EF54710F1580A7A414AE261D7719E50DB90

Function 003F8AF2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 003F8B76
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,003DF782,00000001,00000100,000001B4,00000000), ref: 003F8BC4

Strings

Failed to open uninstall registry key., xrefs: 003F8B39
Failed to enumerate uninstall key for related bundles., xrefs: 003F8BD3
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 003F8B13

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: e21cdd8bc818c749ab3f808f5f45552d645683871636ca11f00b9f55e781841b
Instruction ID: e9ec5459ef683520ef46aa53debab9385fc3da713b063229a9b273ee9afe90b2
Opcode Fuzzy Hash: e21cdd8bc818c749ab3f808f5f45552d645683871636ca11f00b9f55e781841b
Instruction Fuzzy Hash: F021E57291022CFFDF16AB94DC46FEEBA79EF00364F254265F910760A0C6754E90D694

Function 003FCF33 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

WaitForSingleObject.KERNEL32(?,000000FF), ref: 003FCFC8
ReleaseMutex.KERNEL32(?), ref: 003FCFF6
SetEvent.KERNEL32(?), ref: 003FCFFF

Strings

Failed to allocate buffer., xrefs: 003FCF77
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 003FCF6D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 944053411-3017045536
Opcode ID: 8174bf1d8d51fbaea86c83f23332881b10adf696b3282cfe3524045ead193e02
Instruction ID: 5f57507492469abe616cf1464892cf2a7bb57ce25af9594c8be01d0baac9a7e9
Opcode Fuzzy Hash: 8174bf1d8d51fbaea86c83f23332881b10adf696b3282cfe3524045ead193e02
Instruction Fuzzy Hash: 2D21ADB160030ABFDB119F28D845AA9FBF5FF48314F108639F965AB391C375A954CB50

Function 00412823 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 0041288A
SysFreeString.OLEAUT32(?), ref: 004128A5
SysFreeString.OLEAUT32(?), ref: 004128B4

Strings

"0A, xrefs: 0041282D, 0041284C, 0041285A, 00412868, 00412831, 0041284F, 0041285D, 0041286B
"0A, xrefs: 0041282A, 00412836, 00412850, 0041285E, 0041286C, 0041287A, 00412895

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeString
String ID: "0A$"0A
API String ID: 3341692771-1856203917
Opcode ID: 0cf75c6ed8e0c9a7cdaee30dc086b8fc21c03a41f7c4f8274602b6d2705a1a14
Instruction ID: 5ca19c2cca91b42976cd08ecdb17ad3c0a2872030c96ffc04f5bf16473f6af2e
Opcode Fuzzy Hash: 0cf75c6ed8e0c9a7cdaee30dc086b8fc21c03a41f7c4f8274602b6d2705a1a14
Instruction Fuzzy Hash: A2211871A11119FFDB15DF95CA84DEEBBB8EF44344B20429EE505D3110EBB4EA50DB28

Function 003D97FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 003D988D

Strings

Failed to find variable., xrefs: 003D987A
Failed to read next symbol., xrefs: 003D98A9
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 003D982F, 003D9870
Failed to parse condition '%ls' at position: %u, xrefs: 003D983F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 2001391462-1451669575
Opcode ID: d44c956b30d7dbfb3db884c1a2845a12368171a3990d210baeb2eab6e4a26daf
Instruction ID: 8b8938f3eca715b4909f9452e9b1eabedcee8918f2189e8022595ca2ab9add07
Opcode Fuzzy Hash: d44c956b30d7dbfb3db884c1a2845a12368171a3990d210baeb2eab6e4a26daf
Instruction Fuzzy Hash: 34110D339803107ADB276D68FC86F973A19EB16F10F110163FD046D392DA66DD50A6E5

Function 003E49FF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0041A500,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,003E5322), ref: 003E4A4B

Strings

c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 003E4A83
Failed to write message type to pipe., xrefs: 003E4A8D
Failed to allocate message to write., xrefs: 003E4A2A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 3934441357-221464841
Opcode ID: 5c42b3c167cb0bb804e88d35025fc8c3f1f712830b4e21e41ac4383eb701201d
Instruction ID: cc27ae6de5e045f626f4b0a0015eae33f31ec19b6f93ab0c4703c676eb9a5d2c
Opcode Fuzzy Hash: 5c42b3c167cb0bb804e88d35025fc8c3f1f712830b4e21e41ac4383eb701201d
Instruction Fuzzy Hash: 0411D532A80179BBCB22CF46DD05ADE7A78EF44360F114236BD00B6280E734DE00D6A5

Function 003D9DDA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 003D9DFC

Strings

Failed to format path string., xrefs: 003D9E07
Failed get file version., xrefs: 003D9E3C
Failed to set variable., xrefs: 003D9E5B
File search: %ls, did not find path: %ls, xrefs: 003D9E67

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: 15f43ba46edd4f094f543c5ae700657c194d252517fc2737959dbe73a7b6484e
Instruction ID: 957f1e00d6f90e974e4c550efeebcaaf71317ee60409bd87ec150262a07a1d87
Opcode Fuzzy Hash: 15f43ba46edd4f094f543c5ae700657c194d252517fc2737959dbe73a7b6484e
Instruction Fuzzy Hash: 8611BE73D00128BACF13AA94EC42EEEBB78EF00354B214167F800B6351D6359E50ABC0

Function 003E80F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,003E8CEE,0000001A,?,?,00000000,00000000), ref: 003E813F
GetLastError.KERNEL32(?,?,003E8CEE,0000001A,?,?,00000000,00000000,?,?,?), ref: 003E8149

Strings

Failed to create well known SID., xrefs: 003E8177
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 003E811D, 003E816D
Failed to allocate memory for well known SID., xrefs: 003E8127

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2186923214-2807399336
Opcode ID: aafca7462e03b0b8086cdc90318e3a483f48fc6e9ae2e5574779f73e0a7fbba0
Instruction ID: 02ba37fe65b840cea667c2a7003fe78f8aea2dd713497f63865debdf23bf7fbd
Opcode Fuzzy Hash: aafca7462e03b0b8086cdc90318e3a483f48fc6e9ae2e5574779f73e0a7fbba0
Instruction Fuzzy Hash: AC014C37A013357BD2236B52AC06F9B6E6C8F41B60F220127BD04BF2C1EE788D4181E8

Function 003FDA54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 003FDA82
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 003FDAAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,003FDC7A,00000000,?,?,?,00000000,00000000), ref: 003FDAB4

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 003FDAD8
Failed while waiting for download., xrefs: 003FDAE2

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 435350009-842194682
Opcode ID: 851d14e2d386d0dc06c7a0bf50abd347d3619599ba244a5d021cd2dcbb7d1383
Instruction ID: 0e47f29232cf9cbf8d6ca15f05e5a85f929aa567a65e58c5374c80ddee3c2e79
Opcode Fuzzy Hash: 851d14e2d386d0dc06c7a0bf50abd347d3619599ba244a5d021cd2dcbb7d1383
Instruction Fuzzy Hash: 66012533A4923977DB229AA89C0DEEB7AADDB05720F014136FF00F6185D6A89D0481E8

Function 003D5F5A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 003D5F88
GetLastError.KERNEL32 ref: 003D5F92

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D5FB6
Failed to get computer name., xrefs: 003D5FC0
Failed to set variant value., xrefs: 003D5FD9

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 3560734967-833936685
Opcode ID: 6ad7e0c20881f16108aab13545a28b046fba5684e6f0332d2cf6991955f87e74
Instruction ID: 2558dd7740a091fed4221f27d4b94b990e0a3d8b07322ba585c685632c34b33d
Opcode Fuzzy Hash: 6ad7e0c20881f16108aab13545a28b046fba5684e6f0332d2cf6991955f87e74
Instruction Fuzzy Hash: CB01E933A41628A7D712DB65AC41ADE77ECAF08710F110027FD00FB380DA34ED4446E5

Function 003D67C2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 003D67FB
GetLastError.KERNEL32 ref: 003D6805

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D6829
Failed to get temp path., xrefs: 003D6833
Failed to set variant value., xrefs: 003D684F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1238063741-3623708253
Opcode ID: 48da88512c181fdec79f4cc46389891871f7c6f62bfaf098a2720282a6729b41
Instruction ID: 3135071989010d8eac341e1b3b9e15b1f5a2eef7b5682d744ee28f7763070642
Opcode Fuzzy Hash: 48da88512c181fdec79f4cc46389891871f7c6f62bfaf098a2720282a6729b41
Instruction Fuzzy Hash: E8012B73E4123967D322A764AC07FDE37A89F00714F210176FE10FB382EA68AD0446D9

Function 003D5EC2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 003D5ED4

Part of subcall function 0041038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,003D5EE0,00000000), ref: 0041039E
Part of subcall function 0041038A: GetProcAddress.KERNEL32(00000000), ref: 004103A5
Part of subcall function 0041038A: GetLastError.KERNEL32(?,?,?,003D5EE0,00000000), ref: 004103BC

Part of subcall function 00413578: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 004135A5

Strings

Failed to get 64-bit folder., xrefs: 003D5F1E
Failed to get shell folder., xrefs: 003D5F08
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 003D5EFE
Failed to set variant value., xrefs: 003D5F38

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2084161155-2957518125
Opcode ID: def9cf1c3b0b436b5922226b645a6d023a99763322815416e88ec1cdf9b12ae3
Instruction ID: 85593e59a5b34def02437cfe60e621f037d500c2d4144d53b015a96417639344
Opcode Fuzzy Hash: def9cf1c3b0b436b5922226b645a6d023a99763322815416e88ec1cdf9b12ae3
Instruction Fuzzy Hash: AE01A533954628FBDF13A7A0EC06FDE3A6C9B10755F204067F800BE241DB789A449799

Function 00413984 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00413C72: FindFirstFileW.KERNEL32(003F8F6B,?,00000100,00000000,00000000), ref: 00413CAD
Part of subcall function 00413C72: FindClose.KERNEL32(00000000), ref: 00413CB9

SetFileAttributesW.KERNEL32(003F8F6B,00000080,00000000,003F8F6B,000000FF,00000000,?,?,003F8F6B), ref: 004139B3
GetLastError.KERNEL32(?,?,003F8F6B), ref: 004139BD
DeleteFileW.KERNEL32(003F8F6B,00000000,003F8F6B,000000FF,00000000,?,?,003F8F6B), ref: 004139DD
GetLastError.KERNEL32(?,?,003F8F6B), ref: 004139E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00413A02

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3967264933-1688708105
Opcode ID: 34381b60d67c2de7df67c12dc6736ebfae435fab41fc048074dc0b1cd978b97f
Instruction ID: cca82dc13e89511d06296c499738e8767d4f615adaf21ff24dea2e1dc45214ae
Opcode Fuzzy Hash: 34381b60d67c2de7df67c12dc6736ebfae435fab41fc048074dc0b1cd978b97f
Instruction Fuzzy Hash: 3C01D673A01736A7DB214F658D05BDB7D98AF04792F018222FC45FA291D36CDE9085D9

Function 003FD6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003FD6D8
LeaveCriticalSection.KERNEL32(?), ref: 003FD71D
SetEvent.KERNEL32(?,?,?,?), ref: 003FD731

Strings

Failed to get state during job modification., xrefs: 003FD6F1
Failure while sending progress during BITS job modification., xrefs: 003FD70C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: fca6dcb45ddb69827ca63eb0f5336c3a4afc7fb752777b9c34c73892fdb3a2fd
Instruction ID: 3942ba6f68c836e8f02a6d8e19613f8352eabda33a4ecf4a3ecc7252723ae118
Opcode Fuzzy Hash: fca6dcb45ddb69827ca63eb0f5336c3a4afc7fb752777b9c34c73892fdb3a2fd
Instruction Fuzzy Hash: E601F532601629BBCB02AF15D849AAEB7BCFF04324B104126F904DB651D734E908C6D5

Function 003FD4AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,003FDC04,?,?,?,?,?,00000000,00000000,?), ref: 003FD4C4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,003FDC04,?,?,?,?,?,00000000,00000000,?), ref: 003FD4CF
GetLastError.KERNEL32(?,003FDC04,?,?,?,?,?,00000000,00000000,?), ref: 003FD4DC

Strings

Failed to create BITS job complete event., xrefs: 003FD50A
c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 003FD500

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 3069647169-683598956
Opcode ID: 39f18ee9b6c07fa100df419f393945adf9fe5c148f488bc1a8dc70be4729cef7
Instruction ID: 6cc227063c5af56cd90475e042c605d581526c628a92cf46337dc9e475376d08
Opcode Fuzzy Hash: 39f18ee9b6c07fa100df419f393945adf9fe5c148f488bc1a8dc70be4729cef7
Instruction Fuzzy Hash: 2501B9765416366BC3119F59D809A96BFA8FF05720B014137FD08D7741D774E814CBE9

Function 003FD936 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,003FDAA2), ref: 003FD94A
LeaveCriticalSection.KERNEL32(00000008,?,003FDAA2), ref: 003FD98F
SetEvent.KERNEL32(?,?,003FDAA2), ref: 003FD9A3

Strings

Failure while sending progress., xrefs: 003FD97E
Failed to get BITS job state., xrefs: 003FD963

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: ca656499ea636a87222832f6fc08ae4135dc678fde307149f9e690fcb2b1682f
Instruction ID: 938a09c9c0be7ba362c5ff18c3a23a7e82838f35cd55515a10780baa8bad4720
Opcode Fuzzy Hash: ca656499ea636a87222832f6fc08ae4135dc678fde307149f9e690fcb2b1682f
Instruction Fuzzy Hash: 5301F132601628BBC7029B95D94DAAAB7A8FF05B24B400136E605E3A40D7B4A904C6D9

Function 00413209 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 0041324E
SysFreeString.OLEAUT32(00000000), ref: 00413281

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 0041321F, 00413265
`<u, xrefs: 00413281
BT=, xrefs: 00413209

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: BT=$`<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-3723544080
Opcode ID: 11704c951100a5e102f8a46b234a0e122e7d89978dd3b642dc399c508b28fa89
Instruction ID: 88c2c87c1a1114612ddeff19d8d81de32cc48b427093fd1d28d6d06a3654f63f
Opcode Fuzzy Hash: 11704c951100a5e102f8a46b234a0e122e7d89978dd3b642dc399c508b28fa89
Instruction Fuzzy Hash: EA01F231640256BBDB212E94AC08FBB36D8DF50BA2F1041ABFC14AB340C67CCE40529A

Function 003F6951 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(eh?,00000001,?,00000001,00000000,?,?,?,?,?,?,003F6865,00000000), ref: 003F6979
GetLastError.KERNEL32(?,?,?,?,?,?,003F6865,00000000), ref: 003F6983

Strings

eh?, xrefs: 003F6961, 003F6978
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 003F69A7
Failed to stop wusa service., xrefs: 003F69B1

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$eh?
API String ID: 4114567744-1705107433
Opcode ID: a599cc905057eb13e325f18c44ef3f34d9103d333c16466c4557f624341b6592
Instruction ID: 118f8e3ba38285bdaea633ef84ce9ce3aaa4e2927c3b43be6edbe6c9de509338
Opcode Fuzzy Hash: a599cc905057eb13e325f18c44ef3f34d9103d333c16466c4557f624341b6592
Instruction Fuzzy Hash: CE01A733B4113967D7219B65AC46BAF7BE4EF48750F124139FE00BB280DA789D0485D9

Function 003DD461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,003E6F37,000000B8,00000000,?,00000000,75C0B390), ref: 003DD470
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 003DD47F
LeaveCriticalSection.KERNEL32(000000D0,?,003E6F37,000000B8,00000000,?,00000000,75C0B390), ref: 003DD494

Strings

c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 003DD4AD
Engine active cannot be changed because it was already in that state., xrefs: 003DD4B7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 3376869089-1173769119
Opcode ID: 94de585aee77c129b5f071b16688cd1f9cc49c4f8c85c392be19f67be50ae53a
Instruction ID: 50bf6a090dee9acb2499c25461c9167f7f64d68224d067c34e5cb5fdf7f1f3bf
Opcode Fuzzy Hash: 94de585aee77c129b5f071b16688cd1f9cc49c4f8c85c392be19f67be50ae53a
Instruction Fuzzy Hash: 46F0D7772002046B9711AEAAAC88DA733BCBA82724300403AB906C3280EA78F8088664

Function 00411511 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 0041153C
GetLastError.KERNEL32(?,003D4A21,00000001,?,?,003D459E,?,?,?,?,003D54A3,?,?,?,?), ref: 0041154B

Strings

SRSetRestorePointW, xrefs: 00411531
srclient.dll, xrefs: 0041151A
c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 0041156C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\66\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-2605395416
Opcode ID: b6d8385b5bd74ecef9bce8996af4f90c345b29fdf178bfa395244a29752b7db2
Instruction ID: 999ecf10c56bab550589365d71816ddf06ee892c93cb047679d3424641023ac5
Opcode Fuzzy Hash: b6d8385b5bd74ecef9bce8996af4f90c345b29fdf178bfa395244a29752b7db2
Instruction Fuzzy Hash: 2801A273A81732B3C3221795680A7DA29558B88760F114123FF06AA372D66CCCC496DF

Function 00404682 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004046F4
_free.LIBCMT ref: 00404714

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5d00622276514a4a7385acf33e4e2247ada7f9446e8a60aa37cd079696931f9a
Instruction ID: 1886b6a3b305dc3c497762cc9018662aa439b28c11e72c832c1d71833220e2dd
Opcode Fuzzy Hash: 5d00622276514a4a7385acf33e4e2247ada7f9446e8a60aa37cd079696931f9a
Instruction Fuzzy Hash: AA41E276A002049FCB24DFB9C881A6EB3B5EF89314B1545BEE615FB391D735AD01CB84

Function 003D22B5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D22FB
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D2307

Part of subcall function 003D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,003D22D5,000001C7,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3C67
Part of subcall function 003D3C5F: HeapSize.KERNEL32(00000000,?,003D22D5,000001C7,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 003D232B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: 60267a67a010e5c34c5127bf352195cc7b166b8decea87dad18ea29c2ab2df54
Instruction ID: b54c3b890b3b048aa88ae4450c4a49f5696e9296ffac587e37592f6ab152edd5
Opcode Fuzzy Hash: 60267a67a010e5c34c5127bf352195cc7b166b8decea87dad18ea29c2ab2df54
Instruction Fuzzy Hash: F031283B601226ABC7238E65EC44A6B3B99AF25764B124227FC109F390E739CC00C7D1

Function 003D89E8 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,003D8BA7,003D96F4,?,003D96F4,?,?,003D96F4,?,?), ref: 003D8A08
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,003D8BA7,003D96F4,?,003D96F4,?,?,003D96F4,?,?), ref: 003D8A10
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,003D8BA7,003D96F4,?,003D96F4,?), ref: 003D8A5F
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,003D8BA7,003D96F4,?,003D96F4,?), ref: 003D8AC1
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,003D8BA7,003D96F4,?,003D96F4,?), ref: 003D8AEE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 9c3325e785edfa23b4bc510a8a9fbd7b515e6785fdbd8c414c59fb9a9191a344
Instruction ID: 2e015827f7a08ce3465fb9f73ad46a15f9ad6d613e0c14d18c2fe83de2dcc61b
Opcode Fuzzy Hash: 9c3325e785edfa23b4bc510a8a9fbd7b515e6785fdbd8c414c59fb9a9191a344
Instruction Fuzzy Hash: 91315173A01158BFCF178F58DD449AE3F6AEB44350F158417F9098B311CA35AD90DBA0

Function 003D74BE Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(003D53FA,WixBundleOriginalSource,?,?,003EA50A,840F01E8,WixBundleOriginalSource,?,0043AA6C,?,00000000,003D5482,00000001,?,?,003D5482), ref: 003D74CA
LeaveCriticalSection.KERNEL32(003D53FA,003D53FA,00000000,00000000,?,?,003EA50A,840F01E8,WixBundleOriginalSource,?,0043AA6C,?,00000000,003D5482,00000001,?), ref: 003D7531

Strings

Failed to get value as string for variable: %ls, xrefs: 003D7520
Failed to get value of variable: %ls, xrefs: 003D7504
WixBundleOriginalSource, xrefs: 003D74C6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: a56af681767ed140c1bbfb229b6f1038869f80730d833028a4ec441065621cb0
Instruction ID: 5fde3c01a2a1e03eb28f6ec39deeeffb79c57330d54dac3f537ee9beef5a1798
Opcode Fuzzy Hash: a56af681767ed140c1bbfb229b6f1038869f80730d833028a4ec441065621cb0
Instruction Fuzzy Hash: FA01B137944128BBCF135F54EC09A9E7A66EB01324F114026FD00AA321E3399F2097D6

Function 003FCE2C Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,003FCE24,00000000), ref: 003FCE47
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,003FCE24,00000000), ref: 003FCE53
CloseHandle.KERNEL32(0041A518,00000000,?,00000000,?,003FCE24,00000000), ref: 003FCE60
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,003FCE24,00000000), ref: 003FCE6D
UnmapViewOfFile.KERNEL32(0041A4E8,00000000,?,003FCE24,00000000), ref: 003FCE7C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 8ed525ea4430c6c3f48e786a2ece65782294b84147d1c50dc9d83f3b8b1e0ec6
Instruction ID: ce05f7222cd85efdcb3a5dff70c27f816dc8422aa810e70073b3278069028163
Opcode Fuzzy Hash: 8ed525ea4430c6c3f48e786a2ece65782294b84147d1c50dc9d83f3b8b1e0ec6
Instruction Fuzzy Hash: 5D014B32551B19DFCB325F65D980827FBE8BF60712306D93EE29652520C371A850DF80

Function 0040890A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00408922

Part of subcall function 00405CE8: HeapFree.KERNEL32(00000000,00000000,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?), ref: 00405CFE
Part of subcall function 00405CE8: GetLastError.KERNEL32(?,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?,?), ref: 00405D10

_free.LIBCMT ref: 00408934
_free.LIBCMT ref: 00408946
_free.LIBCMT ref: 00408958
_free.LIBCMT ref: 0040896A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dec7a07909a1e9ca1b2e19d7a2a14fa13e27afde03922bf1d7ca6b6f9b331688
Instruction ID: 96810ade83927684970178ed8cbb90d27ed10e1365ba6cf1eb3ec3e36f12331d
Opcode Fuzzy Hash: dec7a07909a1e9ca1b2e19d7a2a14fa13e27afde03922bf1d7ca6b6f9b331688
Instruction Fuzzy Hash: C4F0EC72548A04ABD620EB55E6C5C2B73EDFA00714794183EF084E7691CB38FC804A5D

Function 004048D1 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004048EF

Part of subcall function 00405CE8: HeapFree.KERNEL32(00000000,00000000,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?), ref: 00405CFE
Part of subcall function 00405CE8: GetLastError.KERNEL32(?,?,004089A1,?,00000000,?,00000000,?,004089C8,?,00000007,?,?,00408E2A,?,?), ref: 00405D10

_free.LIBCMT ref: 00404901
_free.LIBCMT ref: 00404914
_free.LIBCMT ref: 00404925
_free.LIBCMT ref: 00404936

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1e09a57305d484d274f2b96b7aaa6677c9452e2e0dd281f04602db3284e284fb
Instruction ID: 1bab2415f4dff049eef5d547ec056cc65d4bca6a74f7eac124553d2d69f51fe4
Opcode Fuzzy Hash: 1e09a57305d484d274f2b96b7aaa6677c9452e2e0dd281f04602db3284e284fb
Instruction Fuzzy Hash: F4F05EB1845B319BDA116F59FC025063B60F714724715357BF660623B1CB3809619FDD

Function 00417ED3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00417FE0
GetLastError.KERNEL32 ref: 00417FEA

Strings

c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp, xrefs: 0041800E
clbcatq.dll, xrefs: 00417EF1, 00417EFC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp$clbcatq.dll
API String ID: 2781989572-2453645868
Opcode ID: 92fa5800709e2ce635847de749124b4cd8c023d309da6a48a83bbe3c51cfcaf6
Instruction ID: b61056dcd879d1a5b4d43744bf0a74fee1d8b1f82a13a6bdcfef9f45da3d09ea
Opcode Fuzzy Hash: 92fa5800709e2ce635847de749124b4cd8c023d309da6a48a83bbe3c51cfcaf6
Instruction Fuzzy Hash: 9C41F736A4820666D720ABB48C05BFF7A75EF54704F15842BF501B7280D67DCE8587A9

Function 00412F2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 00412F46
SysAllocString.OLEAUT32(?), ref: 00412F56
VariantClear.OLEAUT32(?), ref: 00413035

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00412F6E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 2213243845-3017383397
Opcode ID: ad815b1190889b38779e1236693f342cdd7f0b25ce64cff122d1e5483f8b1bf9
Instruction ID: a6057ee0e26be5f6251c4e98ce9d15e1c8a85305ef4bad43e8e6cd2642666dd9
Opcode Fuzzy Hash: ad815b1190889b38779e1236693f342cdd7f0b25ce64cff122d1e5483f8b1bf9
Instruction Fuzzy Hash: 5C41A571900225AFCB119FA4C988EDFBBF8AF09751F0541A6FC11EB205D679DD808B95

Function 004008B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 004008E3
__IsNonwritableInCurrentImage.LIBCMT ref: 0040099C

Strings

csm, xrefs: 00400986
8?, xrefs: 004009B5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: 8?$csm
API String ID: 3480331319-4053358650
Opcode ID: b2762436a4a7dd9348893ec95ce6aeccce978f6c67220a9b31de0fc717b0b10e
Instruction ID: 6a38f513062777a8cff82a5a2f635292770f87bb8fc454b487b7d52127aa67b1
Opcode Fuzzy Hash: b2762436a4a7dd9348893ec95ce6aeccce978f6c67220a9b31de0fc717b0b10e
Instruction Fuzzy Hash: 1A41B474E002089BDB14DF29C854B9EBBA4BF45328F148276E8187B3D2D739DA15CB99

Function 00410708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,003F8B57), ref: 00410763
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,003F8B57,00000000), ref: 00410781
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,003F8B57,00000000,00000000,00000000), ref: 004107D7

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 004107A7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3237223240
Opcode ID: 899864f2374a5365f177580808f6d51f53c68e23cdc194ef11ec85621e689347
Instruction ID: 46d149a7f04eb3c927a2a764502b41db1a760209bcfed96982a3400a6eba2e99
Opcode Fuzzy Hash: 899864f2374a5365f177580808f6d51f53c68e23cdc194ef11ec85621e689347
Instruction Fuzzy Hash: E731A276901129FBEB119A94CD40EEFB66CEF00754F114067FD10AB250D3B89EC09AE8

Function 004039BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\adguard\setup.exe,00000104), ref: 004039F8
_free.LIBCMT ref: 00403AC3
_free.LIBCMT ref: 00403ACD

Strings

C:\Users\user\AppData\Local\Temp\adguard\setup.exe, xrefs: 004039EF, 004039F6, 00403A25, 00403A5D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\adguard\setup.exe
API String ID: 2506810119-3863442885
Opcode ID: 94560732761ea3cdca37bc1bce9b3dfa1c0c3c860c2304ab794d628be30d702e
Instruction ID: 7d33275e29748463484e741d9a738da44aaa07ba6de4ea460616ee547ec274b5
Opcode Fuzzy Hash: 94560732761ea3cdca37bc1bce9b3dfa1c0c3c860c2304ab794d628be30d702e
Instruction Fuzzy Hash: A0319E71B00218ABCB21DF9A988599FBFECEB84711B10407BE944A7281D7799F40CB99

Function 00418B19 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004185F6: lstrlenW.KERNEL32(00000100,?,?,?,00418996,000002C0,00000100,00000100,00000100,?,?,?,003F7AD3,?,?,000001BC), ref: 0041861B

RegCloseKey.ADVAPI32(00000000,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00418BFE
RegCloseKey.ADVAPI32(00000001,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00418C18

Part of subcall function 004104A5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,003E05B1,?,00000000,00020006), ref: 004104CA

Part of subcall function 00410D87: RegSetValueExW.ADVAPI32(00020006,0041FF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,003DF2DF,00000000,?,00020006), ref: 00410DBA

Part of subcall function 00410D87: RegDeleteValueW.ADVAPI32(00020006,0041FF38,00000000,?,?,003DF2DF,00000000,?,00020006,?,0041FF38,00020006,00000000,?,?,?), ref: 00410DEA

Part of subcall function 00410D39: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,003DF237,0041FF38,Resume,00000005,?,00000000,00000000,00000000), ref: 00410D4E

Strings

crypt32.dll, xrefs: 00418B27
%ls\%ls, xrefs: 00418B7A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls$crypt32.dll
API String ID: 3924016894-1754266218
Opcode ID: c028449f32dfb4bca93a7047acb416a5c1dc23e48fbf8495f52638b1a354a831
Instruction ID: bea156f1ac489d1df29bd6716446af38a424062674a3b7c6012b9666ab1d5b2c
Opcode Fuzzy Hash: c028449f32dfb4bca93a7047acb416a5c1dc23e48fbf8495f52638b1a354a831
Instruction Fuzzy Hash: F7311B72C0112AFBCF129FD5DD808DEBB79EF04754B01416BF90076221DB359EA19BA8

Function 003F8857 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,003F8B93,00000000,00000000), ref: 003F8914

Strings

Failed to initialize package from related bundle id: %ls, xrefs: 003F88FA
Failed to open uninstall key for potential related bundle: %ls, xrefs: 003F8883
Failed to ensure there is space for related bundles., xrefs: 003F88C7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: 6953c494c00f31e216fde0eb54ac5261d6fa7e159ef7c28453d8b4e52ad225dc
Instruction ID: 44d331b088d87e42883ff155571c5f7a3b8dee759c5dac76b2c2b83e269b4837
Opcode Fuzzy Hash: 6953c494c00f31e216fde0eb54ac5261d6fa7e159ef7c28453d8b4e52ad225dc
Instruction Fuzzy Hash: 5E21AF7290021DBBDB179F90DC06BFE7B78EF00754F204066FA10A6160DBB5AA60EB95

Function 003D3BA1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,003D146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,003D13B0), ref: 003D3BBF
HeapReAlloc.KERNEL32(00000000,?,003D146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,003D13B0,000001C7,00000100,?,80004005,00000000), ref: 003D3BC6

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

Part of subcall function 003D3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,003D22D5,000001C7,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3C67
Part of subcall function 003D3C5F: HeapSize.KERNEL32(00000000,?,003D22D5,000001C7,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D3C6E

_memcpy_s.LIBCMT ref: 003D3C12

Strings

c:\agent\_work\66\s\src\libs\dutil\memutil.cpp, xrefs: 003D3C53

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\66\s\src\libs\dutil\memutil.cpp
API String ID: 3406509257-1758765531
Opcode ID: 0a17e6027ee3c6144136bd2e808c00453c51e8759a42fca32bb40abe1b883bcf
Instruction ID: 7dcb52b608fff470719cf0badd414339676b49994446a1afcb2e395c4a42831b
Opcode Fuzzy Hash: 0a17e6027ee3c6144136bd2e808c00453c51e8759a42fca32bb40abe1b883bcf
Instruction Fuzzy Hash: 6C11E733611159BBCB236F78BD459AE3B5A9F40760B068623F814AF351D775CF209293

Function 00418109 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041814D
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00418175
GetLastError.KERNEL32 ref: 0041817F

Strings

c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp, xrefs: 004181A0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp
API String ID: 1528435940-2024166147
Opcode ID: e2773d609df56a9fb964e4e40ed5a9907eda665f1a66668b474d6d63b32f2a3b
Instruction ID: 9d6b51b898c8e2426d1b5a3dbe9b7bfcf8d67265094fe14fc5b2da438d72f90d
Opcode Fuzzy Hash: e2773d609df56a9fb964e4e40ed5a9907eda665f1a66668b474d6d63b32f2a3b
Instruction Fuzzy Hash: BB11EC73D41129B7E721DBA4CC44BEFBBA8AF04750F11452AEE41F7240E6389D4586E5

Function 0041002E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(003F1074,00000000,00000000,?,?,?,0040F8EB,003F1074,003F1074,?,00000000,0000FDE9,?,003F1074,8007139F,Invalid operation for this state.), ref: 00410040
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,0040F8EB,003F1074,003F1074,?,00000000,0000FDE9,?,003F1074,8007139F), ref: 0041007C
GetLastError.KERNEL32(?,?,0040F8EB,003F1074,003F1074,?,00000000,0000FDE9,?,003F1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00410086

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 004100B7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-727082060
Opcode ID: 25fac198e6f61782c0b2a732d4d617f2159981e63f3feb6d6ce8b67469dfa8e3
Instruction ID: a0d7f1fa28ed79bf29a4d2d8aed91eba0b416a49d0d8977fc7e95bf01f865bc4
Opcode Fuzzy Hash: 25fac198e6f61782c0b2a732d4d617f2159981e63f3feb6d6ce8b67469dfa8e3
Instruction Fuzzy Hash: B311C673602224A7C3219A75AD44BEF7E68EB49760F114226FD01E7240D6B8DDC086E9

Function 003D1206 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,003D527C,00000000,?), ref: 003D1244
GetLastError.KERNEL32(?,?,?,003D527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 003D124E

Strings

ignored , xrefs: 003D1213
c:\agent\_work\66\s\src\libs\dutil\apputil.cpp, xrefs: 003D126F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: c:\agent\_work\66\s\src\libs\dutil\apputil.cpp$ignored
API String ID: 3459693003-1283515844
Opcode ID: 49d3e6326865e4d2dbc78673a41fbe4ebd6bab779766f3cc14bec894ea5f7f53
Instruction ID: 3b5ec29ab6bc8cc4a5c81718d3784b21d1f97c9236694fa035acfd040e996d8c
Opcode Fuzzy Hash: 49d3e6326865e4d2dbc78673a41fbe4ebd6bab779766f3cc14bec894ea5f7f53
Instruction Fuzzy Hash: 76118F77901129BBCB22DB99E805EDEBBB8AF44B50B024157FD00EB311E7719E10DAA0

Function 0040F6FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,0040FDC0,?,?,?,?,00000001), ref: 0040F71C
GetLastError.KERNEL32(?,0040FDC0,?,?,?,?,00000001,?,003D5651,?,?,00000000,?,?,003D53D2,00000002), ref: 0040F728
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,0040FDC0,?,?,?,?,00000001,?,003D5651,?,?), ref: 0040F791

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0040F747

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-727082060
Opcode ID: e22610200ea43bbdcdfdbe480ef0f27d01eb596fbd162b357b2bf4f507dd5325
Instruction ID: b4229a77abdee068b75ca8bb114241307543e8ef6de15a728d56fad17fe5e9f1
Opcode Fuzzy Hash: e22610200ea43bbdcdfdbe480ef0f27d01eb596fbd162b357b2bf4f507dd5325
Instruction Fuzzy Hash: B411BF32601225EBDB319F90CD05EEF7A69EF54750F01803AFD00A76A0D6348E65E6A6

Function 003FCE8D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,74DF30D0,?,?,003FD0C2,00000000,00000000,00000000,00000000), ref: 003FCE9D
ReleaseMutex.KERNEL32(?,?,003FD0C2,00000000,00000000,00000000,00000000), ref: 003FCF24

Part of subcall function 003D39DF: GetProcessHeap.KERNEL32(?,000001C7,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F0
Part of subcall function 003D39DF: RtlAllocateHeap.NTDLL(00000000,?,003D237C,?,00000001,80004005,8007139F,?,?,0040FB39,8007139F,?,00000000,00000000,8007139F), ref: 003D39F7

Strings

c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 003FCEE2
Failed to allocate memory for message data, xrefs: 003FCEEC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 2993511968-3819074818
Opcode ID: 6f70ef0518e401e82712a3f27258a7f2014385843369947cc816199d77d8a814
Instruction ID: 9b88195994478f104cf884ae224e2656684a4538cc43598bd756e531e51232b8
Opcode Fuzzy Hash: 6f70ef0518e401e82712a3f27258a7f2014385843369947cc816199d77d8a814
Instruction Fuzzy Hash: EF1191B1300219AFC716DF28E895EA6BBF5FF09724B104175F9159B3A1C771AC20CB98

Function 004145C9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,003E0458,00000000,?,003DF49C,0041A500,00000080,002E0032,00000000), ref: 004145E1
GetLastError.KERNEL32(?,003DF49C,0041A500,00000080,002E0032,00000000,?,003E0458,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 004145EE
CloseHandle.KERNEL32(00000000,00000000,0041A500,003DF49C,?,003DF49C,0041A500,00000080,002E0032,00000000,?,003E0458,crypt32.dll,00000094), ref: 00414642

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00414612

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-1688708105
Opcode ID: f28aa29d41bea7b5d365c80964b817e7fdce234cf0bd19d9ec5f1d1ac6660361
Instruction ID: 530bb3aa6282f58949ef1f098aaebb11163f495fa331a9e337e27cda73beaa9c
Opcode Fuzzy Hash: f28aa29d41bea7b5d365c80964b817e7fdce234cf0bd19d9ec5f1d1ac6660361
Instruction Fuzzy Hash: 7D01D43364212567DB210E699C05FDB3E549B96B74F064212FE24AB2D0C73D8C51A6AD

Function 00414199 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,003F89B4,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 004141CD
GetLastError.KERNEL32(?,003F89B4,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 004141DA

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 004141AE, 004141FE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-1688708105
Opcode ID: 4a6299af56302e1e8a143b1cab7ae45d6404bbb1a06b968e903b917aebf48e17
Instruction ID: 8ed9ff8c95a952d6894ce712f2988810084028464d2241d7bbde6066ba49742e
Opcode Fuzzy Hash: 4a6299af56302e1e8a143b1cab7ae45d6404bbb1a06b968e903b917aebf48e17
Instruction Fuzzy Hash: 6A01DB33681131B7D62126949C09FEB29589B55BB0F128163FE107F2D1C67D4D8162ED

Function 003E06B6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 003E0726

Strings

Failed to open registration key., xrefs: 003E06DD
Failed to update resume mode., xrefs: 003E06F7
Failed to update name and publisher., xrefs: 003E0710

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 51d02190c07fc0647cfe177b310e89e1f1cd0e69ec94c3ca4f225275cbad1e08
Instruction ID: 6f52a9440cc7d4f6e4c36a9a1d30004f75f0b23fa7f355370eb4d71bb122c543
Opcode Fuzzy Hash: 51d02190c07fc0647cfe177b310e89e1f1cd0e69ec94c3ca4f225275cbad1e08
Instruction Fuzzy Hash: 1601D833A40238FBCB175A91DC41F9E7B79EB01754F200116F500B62D1D7B4AE509BC4

Function 00413183 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(0041A594), ref: 004131C8
SysFreeString.OLEAUT32(00000000), ref: 004131FB

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00413199, 004131DF
`<u, xrefs: 004131FB

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 2f6a5c7e942556fcdcffd84010b0cf1c9d26ce0b6d79f9ede3a40cbc5dd49ae5
Instruction ID: 4c4c683653e779369427991ce05bd6e80e83e81b9136d52686a6714494e95e02
Opcode Fuzzy Hash: 2f6a5c7e942556fcdcffd84010b0cf1c9d26ce0b6d79f9ede3a40cbc5dd49ae5
Instruction Fuzzy Hash: A601DF3124425ABBE7211E554D09FEB36A99F41762F104037FD14AB340C67C8E85929A

Function 0041608D Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004160EC

Part of subcall function 00417ED3: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00417FE0
Part of subcall function 00417ED3: GetLastError.KERNEL32 ref: 00417FEA

Strings

clbcatq.dll, xrefs: 004160B9
`<u, xrefs: 004160EC
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 004160DA

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$clbcatq.dll
API String ID: 211557998-485600161
Opcode ID: e62275e071ed59224b9f612beb51d17f2d08be7e66a8ecd215fb6e69eec9d18c
Instruction ID: c43e4dce2299e4bda125fc9946d0e3bc10ec030221341af31e470a6ff2a623c6
Opcode Fuzzy Hash: e62275e071ed59224b9f612beb51d17f2d08be7e66a8ecd215fb6e69eec9d18c
Instruction Fuzzy Hash: A501A272902126FF8B20DF85D9418DAFEA8FF18360B12C17BE604A7210D379DE54D7A9

Function 003EEB14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 003EEB3C
GetLastError.KERNEL32 ref: 003EEB46

Strings

c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EEB6A
Failed to post elevate message., xrefs: 003EEB74

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post elevate message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-3565835173
Opcode ID: 979c35a900ccfc70c2206f0d4236258d2b824a68fdbb18f2c820fac35045b7d5
Instruction ID: 8044a37e68ffa29bcf2d3b616dfbea0173b993074250ceeb513662d0663dce62
Opcode Fuzzy Hash: 979c35a900ccfc70c2206f0d4236258d2b824a68fdbb18f2c820fac35045b7d5
Instruction Fuzzy Hash: 0CF04C33A15276A7C72156955C05E8337847F00B30F128335FE25BF2C1D7259C0182D8

Function 003DD88A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 003DD8B1
FreeLibrary.KERNEL32(?,?,003D4920,00000000,?,?,003D54CB,?,?), ref: 003DD8C0
GetLastError.KERNEL32(?,003D4920,00000000,?,?,003D54CB,?,?), ref: 003DD8CA

Strings

BootstrapperApplicationDestroy, xrefs: 003DD8A9

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: 3163d92013e16d0241a3446ded82ba754f31abcaefba007c15b97b450ad4d14b
Instruction ID: 140439ccd1f81170658c85222cddaf24d79173ec668c1a67ef8ccab7b7c88f69
Opcode Fuzzy Hash: 3163d92013e16d0241a3446ded82ba754f31abcaefba007c15b97b450ad4d14b
Instruction Fuzzy Hash: B4F09633601626ABC7135FA5E804B66FBA8FF04762706C23AE815D7650D735EC60EBD4

Function 00412A57 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00412A6C
SysFreeString.OLEAUT32(00000000), ref: 00412A9C

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00412A80
`<u, xrefs: 00412A9C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 46ba9a1502e0d45b66861e350dda7b8da28599390470d23e6ec1431627bf97d3
Instruction ID: 5ce276e2336db3b8786734eaf9af27d12ef8edde9b87620740a50ec4bc598b38
Opcode Fuzzy Hash: 46ba9a1502e0d45b66861e350dda7b8da28599390470d23e6ec1431627bf97d3
Instruction Fuzzy Hash: 2EF0B435242565EBC7324F009D08FEF7BA59F807A1F24402AFC18AB310C7B88D709AD9

Function 00412CFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00412D11
SysFreeString.OLEAUT32(00000000), ref: 00412D41

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00412D28
`<u, xrefs: 00412D41

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: e9d6e2963cfc049544d02f8597d681918ff5158188d3d6f01b718736ac34b6c5
Instruction ID: 11cb6600b38a50d27a5f3037d807ed8d5f4ace6bcdb37ef874d07a0e05c335bc
Opcode Fuzzy Hash: e9d6e2963cfc049544d02f8597d681918ff5158188d3d6f01b718736ac34b6c5
Instruction Fuzzy Hash: 0CF0B435101595ABC7225F04ED08FEB7BA8DF40760F114027FC149B320C7BCCD619AA9

Function 003EF11E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 003EF133
GetLastError.KERNEL32 ref: 003EF13D

Strings

Failed to post plan message., xrefs: 003EF16B
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EF161

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-4270167399
Opcode ID: 8031e8ed46787add62e9ecd9e6c1a11429fab2b922341e5007761232d0e6180d
Instruction ID: 679be1d640db269f911beca099d5c23e508b84c3a1226567ae2af2a9df02c6cb
Opcode Fuzzy Hash: 8031e8ed46787add62e9ecd9e6c1a11429fab2b922341e5007761232d0e6180d
Instruction Fuzzy Hash: 42F0A733651235BBD6226AA6AC09E977E94AF05BB0B124131BD18BE3C1E5659C0085E9

Function 003EF22C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 003EF241
GetLastError.KERNEL32 ref: 003EF24B

Strings

Failed to post shutdown message., xrefs: 003EF279
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EF26F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-519151043
Opcode ID: 5667d6c1fcf5d6295c02ac8e322957bf1be33d593b771b2d9ccdf0db3c83c908
Instruction ID: bfe21356b42411632bc549cc38205470892dc1d752c1c36169dd1312c0088f84
Opcode Fuzzy Hash: 5667d6c1fcf5d6295c02ac8e322957bf1be33d593b771b2d9ccdf0db3c83c908
Instruction Fuzzy Hash: 4AF0A73B6422356BD3221AE6AC09F877E54BF05B60F134536BF08BE2C1E6649C0086E9

Function 003F0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(0041A478,00000000,?,003F14B9,?,00000000,BT=,003DC24A,?,BT=,?,003E7498,?,?,003D5442,?), ref: 003F056E
GetLastError.KERNEL32(?,003F14B9,?,00000000,BT=,003DC24A,?,BT=,?,003E7498,?,?,003D5442,?,003D5482,00000001), ref: 003F0578

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 003F059C
Failed to set begin operation event., xrefs: 003F05A6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-3321223842
Opcode ID: 836665c1a6712485619f1a182934f80359c0dfbb8dd4464224a53279c0d1416c
Instruction ID: 9aa33feaef1c41ae701f4d9c1c8caf39c42b9ea0acaf51627446adc4a92528e7
Opcode Fuzzy Hash: 836665c1a6712485619f1a182934f80359c0dfbb8dd4464224a53279c0d1416c
Instruction Fuzzy Hash: A8F05433A4623927831612996D05BE776C85F097607020036FF04FB342F558DC0046D9

Function 003EEA1A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 003EEA2F
GetLastError.KERNEL32 ref: 003EEA39

Strings

Failed to post apply message., xrefs: 003EEA67
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EEA5D

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post apply message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-1324423724
Opcode ID: 9d533a6cab6edfcafe245e02e418fbad672ed7be92a8788b04898368c6535141
Instruction ID: b77ff0efd140925c7c15a0ff051cc560b3a4fad9f9d7ed5681c446ac25ea69cf
Opcode Fuzzy Hash: 9d533a6cab6edfcafe245e02e418fbad672ed7be92a8788b04898368c6535141
Instruction Fuzzy Hash: 05F0A7336412356BD62256A66C09E87BE94BF05B60B034135BD18BE2C1E5289C0085E9

Function 003EEAAB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 003EEAC0
GetLastError.KERNEL32 ref: 003EEACA

Strings

c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 003EEAEE
Failed to post detect message., xrefs: 003EEAF8

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-2517332631
Opcode ID: 95a683cf8335939bdc24579b9150224accfdf46f85c0ae4dbe571c023dbf6d6b
Instruction ID: 10aa941a152f2eef9ea4d9b7b0a6aa6fa5ec0a13f4488c9a940367295685f4e9
Opcode Fuzzy Hash: 95a683cf8335939bdc24579b9150224accfdf46f85c0ae4dbe571c023dbf6d6b
Instruction Fuzzy Hash: F1F0A733A4123567D2321A966C09F87BE94BF05B61F134136BE18BE2D1D5249C00C6E9

Function 004063C9 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00406454
__alldvrm.LIBCMT ref: 00406655
__alldvrm.LIBCMT ref: 00406677

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction ID: 0aa9345edaebfaa30acf6edbd343364ce59c13ad8d152c69db5cde24d91ec86d
Opcode Fuzzy Hash: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction Fuzzy Hash: 09A13672900286AFDB218F28C891BAABBE5EF11314F1A457FD486AB3C1C63D8D51C758

Function 004156B4 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00415781
lstrlenW.KERNEL32(00000000), ref: 00415799

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00415822

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 1659193697-16760509
Opcode ID: fdce1e3a2558aa8b09209cfccdec599fb1037eafe7262db73e19a0d159eb3f15
Instruction ID: fffe80c1c5fdeb1363d9faab87e4c7e59286987d4e102c26b169461757d12542
Opcode Fuzzy Hash: fdce1e3a2558aa8b09209cfccdec599fb1037eafe7262db73e19a0d159eb3f15
Instruction Fuzzy Hash: 75519376D01619EBCB119FA4CC80AEFBBB9EFC8750F15402AE904B7250D778DD918BA4

Function 00418352 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041846B

Strings

WA, xrefs: 00418394
<, xrefs: 004183BC
c:\agent\_work\66\s\src\libs\dutil\uriutil.cpp, xrefs: 0041848C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLast
String ID: WA$<$c:\agent\_work\66\s\src\libs\dutil\uriutil.cpp
API String ID: 1452528299-1404258677
Opcode ID: cd0f41b98af4abb244918c8e5ba7293f935956c61c90b412529bf59cd7faddd4
Instruction ID: a9f8846853467d4ac9c9cdd393436d506a4da93c66a1ac27b310b7fd7d976a2d
Opcode Fuzzy Hash: cd0f41b98af4abb244918c8e5ba7293f935956c61c90b412529bf59cd7faddd4
Instruction Fuzzy Hash: A4510B72D012399BDB32DF55CC88ADAB7B9AF08710F4145EBA908A7311EB349EC48F55

Function 003D4FE1 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,003D558F,?,?,?,?,?,?), ref: 003D503B
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,003D558F,?,?,?,?,?,?), ref: 003D504F
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,003D558F,?,?), ref: 003D513E
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,003D558F,?,?), ref: 003D5145

Part of subcall function 003D115F: LocalFree.KERNEL32(?,?,003D4FF8,?,00000000,?,003D558F,?,?,?,?,?,?), ref: 003D1169

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: 8a91cbc19cbfda208e2ba0f43c328db79694ef74f9463cf9bca94eb2d3a064cb
Instruction ID: 3181ca02335cf4812704faa2a57fb7e57895a372938e29e6f43836ec56b7cbf4
Opcode Fuzzy Hash: 8a91cbc19cbfda208e2ba0f43c328db79694ef74f9463cf9bca94eb2d3a064cb
Instruction Fuzzy Hash: CF41FE72500B05ABDA72EBB5E849FDB73ECAF14701F44482AB29ADB251DB34F544C724

Function 003D4CC9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 003DF90C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,003D4CE8,?,?,00000001), ref: 003DF95C

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 003D4D4F

Strings

Unable to get resume command line from the registry, xrefs: 003D4CEE
Failed to get current process path., xrefs: 003D4D0D
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 003D4D39

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: 9fcb0ec84187ebf36927420349a62748d85b9ebfe8c83a0b36448f57fda9d85f
Instruction ID: 72a4d4338a9d7efc502a67094d0744a547d683ee2ee33c17e56158a65d2eafb3
Opcode Fuzzy Hash: 9fcb0ec84187ebf36927420349a62748d85b9ebfe8c83a0b36448f57fda9d85f
Instruction Fuzzy Hash: D9117F32D01218BBCF23ABA5E8018DEBBB9EF50710B214167F811B6316E7349B509A80

Function 0040815F Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00408303,00000000,00000000,?,00408106,00408303,00000000,00000000,00000000,?,00408303,00000006,FlsSetValue), ref: 00408191
GetLastError.KERNEL32(?,00408106,00408303,00000000,00000000,00000000,?,00408303,00000006,FlsSetValue,00431A28,FlsSetValue,00000000,00000364,?,004059FB), ref: 0040819D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00408106,00408303,00000000,00000000,00000000,?,00408303,00000006,FlsSetValue,00431A28,FlsSetValue,00000000), ref: 004081AB

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 124b51a4fff21b44cf3b5a84ae6ab2e4279fe08076b3ea2e2ac3f8e12a954702
Instruction ID: 42ab95776eaa1a0117d5ba9b75e5f1592d8c471bb8b0a3225fa173ed2cf63b28
Opcode Fuzzy Hash: 124b51a4fff21b44cf3b5a84ae6ab2e4279fe08076b3ea2e2ac3f8e12a954702
Instruction Fuzzy Hash: 61014736606322ABC7214B689C04AA77758AF457B0B140539FD45FB3C0DF38C80286EC

Function 003D743E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003D744A
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 003D74B1

Strings

Failed to get value as numeric for variable: %ls, xrefs: 003D74A0
Failed to get value of variable: %ls, xrefs: 003D7484

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: 54f3d3cd69fa5d5db6fcdb3bd745fdd5a691753d7b3924b56b61e6ea48d2e0b5
Instruction ID: 0a54d1579c17249b1a5550f1fa0d07f0728c1e1a68988162162b7ee75cd2fa98
Opcode Fuzzy Hash: 54f3d3cd69fa5d5db6fcdb3bd745fdd5a691753d7b3924b56b61e6ea48d2e0b5
Instruction Fuzzy Hash: 0101BC73944128BBCF135F55DC06ADE7E39AF10329F218126FD04AA321E3399E1097D4

Function 003D75AD Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 003D75B9
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 003D7620

Strings

Failed to get value as version for variable: %ls, xrefs: 003D760F
Failed to get value of variable: %ls, xrefs: 003D75F3

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: c82165f20985bb9c0487959801114405854fbe40413c0855f8a862026c23e01d
Instruction ID: 6a57c7cc0ef5b9f6b211b0149493d84aa5e767f2446bebafe37a4f9e36fa7ad3
Opcode Fuzzy Hash: c82165f20985bb9c0487959801114405854fbe40413c0855f8a862026c23e01d
Instruction Fuzzy Hash: 4D01BC33944528BBCF125B48EC09A8E7B29EB11324F118062FD00AA221E339DA109BE9

Function 003D753E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,003D985C,00000000,?,00000000,00000000,00000000,?,003D969D,00000000,?,00000000,00000000), ref: 003D754A
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,003D985C,00000000,?,00000000,00000000,00000000,?,003D969D,00000000,?,00000000), ref: 003D75A0

Strings

Failed to copy value of variable: %ls, xrefs: 003D758F
Failed to get value of variable: %ls, xrefs: 003D7570

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: 5705fc6bbb21fe40576dc4e4a6d5b13594e567567297a76cc30b4c942ba1769f
Instruction ID: 1b9b06fd425d10037766624b969af3d73b15e59c4b6e98b1857f22608234ec99
Opcode Fuzzy Hash: 5705fc6bbb21fe40576dc4e4a6d5b13594e567567297a76cc30b4c942ba1769f
Instruction Fuzzy Hash: B3F08C72940228BBCF026B54EC05ADE3B2AEF05364F108022FC04AA261D3399A209B99

Function 003D7F3B Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,74DEDFD0,?,BT=,003E5C58,0041A4A0,BT=,?,BT=,00000000,00000000,003D53FA,00000000), ref: 003D7F47
LeaveCriticalSection.KERNEL32(00000000,00000000,003D53FA,00000000,?,BT=,003E5C58,0041A4A0,BT=,?,BT=,00000000,00000000,003D53FA,00000000), ref: 003D7F95

Strings

BT=, xrefs: 003D7F3B
Failed to get visibility of variable: %ls, xrefs: 003D7F77

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: BT=$Failed to get visibility of variable: %ls
API String ID: 3168844106-3797718303
Opcode ID: 10a6c68ccf0a1d3b4836b6a7b934c7bc22c433105fba4ead40be01d17e23bc13
Instruction ID: a349ee2a3d4e793a68a26fd22269838b6d92bd246b28d0641e76fc4a5d41a6b0
Opcode Fuzzy Hash: 10a6c68ccf0a1d3b4836b6a7b934c7bc22c433105fba4ead40be01d17e23bc13
Instruction Fuzzy Hash: 0CF01976504128FFCB129F54DC05A9E7B78EF05355F118161FC05AB360E7759E209B94

Function 0040DC03 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0040D5DF), ref: 0040DC26

Strings

tOC, xrefs: 0040DCD8
8?, xrefs: 0040DC9C, 0040DD36, 0040DDEE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: DecodePointer
String ID: 8?$tOC
API String ID: 3527080286-2660559385
Opcode ID: 29d525a6f6d916042b032faeff7934a1c0be09e76f8bf57f7c9543d4db21930d
Instruction ID: cb5eeca966cd53fe98aa27cecb6f431365c3c9cf654d381108c5ebe18d0b3641
Opcode Fuzzy Hash: 29d525a6f6d916042b032faeff7934a1c0be09e76f8bf57f7c9543d4db21930d
Instruction Fuzzy Hash: 78517A70D04509CBCB10DFA8E9485EDBFB4FF49314F6441A6E481BA2A4CB799928CB5D

Function 00410517 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00410692

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 0041067F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3535843008-3237223240
Opcode ID: f95a6f0694f1578018f521679921704a03db13aaac235451ea2b262451b36121
Instruction ID: f283d9cd550da45abbfc6f85b2da57c02e07ab3b76add8b7e359f0acdad1ed52
Opcode Fuzzy Hash: f95a6f0694f1578018f521679921704a03db13aaac235451ea2b262451b36121
Instruction Fuzzy Hash: 9441C232D40225FFDF329A54CC04BEE7A62AB80760F158127E904AB250D7BDCDE19BD8

Function 00413FBE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,?,00000000,00000101), ref: 0041411F

Strings

PendingFileRenameOperations, xrefs: 0041400F, 004140F7
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00413FCF

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: 8753a150daf47a34960b948d694634e289cb9981388d6224d89220fdbb302c10
Instruction ID: 8f47ad64ac1e18af39853af43c0de0097f5d329ce4b0209cf1a531099accfdd8
Opcode Fuzzy Hash: 8753a150daf47a34960b948d694634e289cb9981388d6224d89220fdbb302c10
Instruction Fuzzy Hash: E1419E31E00215FBCB21DF95C9459EEBBB5EB98700F21406BE505AB311D7398EC1CB58

Function 0041095E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004109D4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00410A0C

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00410A48

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: QueryValue
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3660427363-3237223240
Opcode ID: c835d3362377835fb4fc964ff37ad48894dfa7ffba5814ac932d26bad70de8bc
Instruction ID: d744407b9ff8da04ac56cc3d8021d6a4d8aaf3e706239c9e43d811a7d9a02913
Opcode Fuzzy Hash: c835d3362377835fb4fc964ff37ad48894dfa7ffba5814ac932d26bad70de8bc
Instruction Fuzzy Hash: 1E417272E0022AEBDB21DE94C841AEFB7B9AF10790F10416BE910AB251D7748ED1CB94

Function 00405F23 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0041A518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 00405FF6
GetLastError.KERNEL32 ref: 00406012

Strings

comres.dll, xrefs: 00405F9D, 00405FEB, 00406027

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: 84630e511314e40c71269b0c542283687c88fa50c68bad1e5ec9754c32982f5a
Instruction ID: 6bfe402c4c3c23be15aa090523f92fc85889883ea7e34ba9c1356df78e32ecb9
Opcode Fuzzy Hash: 84630e511314e40c71269b0c542283687c88fa50c68bad1e5ec9754c32982f5a
Instruction Fuzzy Hash: 1531D170600A12ABDB219E59C884AAB7BACDF41751F15407BF805AB3D0DA3D8D01CBAA

Function 00418705 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004185F6: lstrlenW.KERNEL32(00000100,?,?,?,00418996,000002C0,00000100,00000100,00000100,?,?,?,003F7AD3,?,?,000001BC), ref: 0041861B

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0041A500,wininet.dll,?), ref: 00418805
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,0041A500,wininet.dll,?), ref: 00418812

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

Part of subcall function 00410708: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,003F8B57), ref: 00410763
Part of subcall function 00410708: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,003F8B57,00000000), ref: 00410781

Strings

wininet.dll, xrefs: 0041877A, 004187C7

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: 485a37bd90cedf423659e73717c58d530ad1357d55d27770f45df70065b0f78e
Instruction ID: e7e2c5e0fee24c7fe8cf040375a34b5375d6568782e46925a0752e39e227d276
Opcode Fuzzy Hash: 485a37bd90cedf423659e73717c58d530ad1357d55d27770f45df70065b0f78e
Instruction Fuzzy Hash: A1311A32C00129ABCF12AF958D808EFBB75EB04754B21416FE91076221CB398E90DB94

Function 003D3ADB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 003D3B3E

Strings

wininet.dll, xrefs: 003D3AFC
crypt32.dll, xrefs: 003D3AFB, 003D3B3A, 003D3B3C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 4ae1699a8e0cffef73e401e02ee7f8f13826bdea54519662f1ff0bf1fc8a425b
Instruction ID: 094bf847d2c6501bd0b7b56b404a9df8c905bc05e370a93b53dce7d3dd07386c
Opcode Fuzzy Hash: 4ae1699a8e0cffef73e401e02ee7f8f13826bdea54519662f1ff0bf1fc8a425b
Instruction Fuzzy Hash: C2115E72700219AFCF09DF29DCD59AF7F69EF85294B15802AFD058B311D670EE108AE0

Function 003E3A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,003E3F3C,feclient.dll,?,00000000,?,?,?,003D4B57), ref: 003E3ACD

Part of subcall function 0041095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 004109D4
Part of subcall function 0041095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00410A0C

Strings

Logging, xrefs: 003E3A5A
SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 003E3A43

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 780fa2bad756cf2864f877c5c2eee2c1d0c6e3bd98c7b3abb9c7908b9d28cb5b
Instruction ID: a8f33e2157db6d546fe10c4bd45a37c692396129f12f24a21382f62a53d289bd
Opcode Fuzzy Hash: 780fa2bad756cf2864f877c5c2eee2c1d0c6e3bd98c7b3abb9c7908b9d28cb5b
Instruction Fuzzy Hash: D3113836600265BBEB26DA82D90EFFAB768AB00715FA14266E881A71D0C7749FC18754

Function 00406F81 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00406FCD
GetFileType.KERNEL32(00000000), ref: 00406FDF

Strings

G(, xrefs: 00407016

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FileHandleType
String ID: G(
API String ID: 3000768030-1857873316
Opcode ID: 5eddfc8e96906500635187509c9ff73636a07a472104883737960456de9d33c5
Instruction ID: dab2120f75e572eb8426391ece003b04ff65d883fc6917e98604d4d45b6be613
Opcode Fuzzy Hash: 5eddfc8e96906500635187509c9ff73636a07a472104883737960456de9d33c5
Instruction Fuzzy Hash: C811877251874346C7304A3DAD986237A949756330F39073BD1B7E66F1C73CE896924E

Function 00406D7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00406DA8
_free.LIBCMT ref: 00406DCE

Strings

G(, xrefs: 00406DA3, 00406DB0, 00406DC9, 00406DD6, 00406DFC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free
String ID: G(
API String ID: 269201875-1857873316
Opcode ID: 74c84e860b427e8d0eeacd4a96f84551baa2bc6874f0c79dbb27615b36b3cfb4
Instruction ID: a4d59ac697e00fb3635e173ca3c10a7be9292e51923da226ddb71aa154f30bd1
Opcode Fuzzy Hash: 74c84e860b427e8d0eeacd4a96f84551baa2bc6874f0c79dbb27615b36b3cfb4
Instruction Fuzzy Hash: 5111E271B007215BDF209F29EC45B5637A4EB60764F05123BFA21EB2E0E778D85246CD

Function 00410D87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,0041FF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,003DF2DF,00000000,?,00020006), ref: 00410DBA
RegDeleteValueW.ADVAPI32(00020006,0041FF38,00000000,?,?,003DF2DF,00000000,?,00020006,?,0041FF38,00020006,00000000,?,?,?), ref: 00410DEA

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00410E1E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Value$Delete
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 1738766685-3237223240
Opcode ID: b4d5bdc1fdbdeb8d36f7844b994dce803f54acab62fd717069bcd181c04af18d
Instruction ID: 722f2dbc2f3ae7a3f119b46b557913756c27d9484c809dcbbb1c51c6069f5708
Opcode Fuzzy Hash: b4d5bdc1fdbdeb8d36f7844b994dce803f54acab62fd717069bcd181c04af18d
Instruction Fuzzy Hash: 6611253394123AB7DB314A958D05BEFBA61EB04760F114526FE00BE290D7B8DDD097E8

Function 003DDD59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,003F73ED,00000000,IGNOREDEPENDENCIES,00000000,?,0041A518), ref: 003DDDAA

Strings

IGNOREDEPENDENCIES, xrefs: 003DDD61
Failed to copy the property value., xrefs: 003DDDDE

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: b589c8075f75d2658becb86146cd614278e48182ea275e9b76cd11cdc00786ac
Instruction ID: 5da6ff0f7eb38b2e69b16d969f703c2748e59cfd470d81be6a517de63b957dfa
Opcode Fuzzy Hash: b589c8075f75d2658becb86146cd614278e48182ea275e9b76cd11cdc00786ac
Instruction Fuzzy Hash: BE11A333200215AFDF128F54EC84FA9B7A6AF04324F264177FA199B3A1CB70A850CA84

Function 003D1578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,003E6FDF,00000000,003E6FDF,00000000,00000000,003E6FDF,00000000,00000000,00000000,?,003D2420,00000000,00000000), ref: 003D15BC
GetLastError.KERNEL32(?,003D2420,00000000,00000000,003E6FDF,00000200,?,00414ABC,00000000,003E6FDF,00000000,003E6FDF,00000000,00000000,00000000), ref: 003D15C6

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 003D15EA

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorLastString
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3728238275-792799584
Opcode ID: d5dd7c1703349e3e8fe215fa2911bef9cf77a8303be4b8e26a0f0056d6dc3aad
Instruction ID: 344104bd835876163fa68c25a00ba97ae14be993b7d47fd6de1ee7072de4f3d3
Opcode Fuzzy Hash: d5dd7c1703349e3e8fe215fa2911bef9cf77a8303be4b8e26a0f0056d6dc3aad
Instruction Fuzzy Hash: 7901F53394123677CB238E95BC04E977A6AAF86B70B020222FE10AF341D624DC1087E1

Function 003E573C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 003E5759
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 003E57B2

Strings

Failed to initialize COM on cache thread., xrefs: 003E576E

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: af0aaaba115f728085cddb5c8887512111abdba5252c7e83f3fc7209a4832b7a
Instruction ID: 2cc1ec5a428a206aeba7680b5068755b71ab3a80657ad7638edb7c31b74027d7
Opcode Fuzzy Hash: af0aaaba115f728085cddb5c8887512111abdba5252c7e83f3fc7209a4832b7a
Instruction Fuzzy Hash: 8C01A172600618FFDB068B95EC84DEAFBADFF09354B10813AF90597260DB70AD10CB94

Function 00414E42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,003E8D6E,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00414E71
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,003E8D6E,?), ref: 00414E8C

Strings

c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp, xrefs: 00414EB0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp
API String ID: 2352087905-2024494872
Opcode ID: 89cbe4a94056232f3d2580d5cc0bfbe73332329ddc0169d24bfc32608ab022fe
Instruction ID: fdfec82cdb3c7e7e80bd34259cd455ea2129a645175dcb836bd7f46396b3bb89
Opcode Fuzzy Hash: 89cbe4a94056232f3d2580d5cc0bfbe73332329ddc0169d24bfc32608ab022fe
Instruction Fuzzy Hash: E1018E33801229FBCF229E949D05ACF7E66FF84761F024116FD0466250C3398D609BD8

Function 00408397 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,BCE85006,00000001,?,000000FF), ref: 00408408

Strings

LCMapStringEx, xrefs: 004083A8, 004083B2
8?, xrefs: 004083E4

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String
String ID: 8?$LCMapStringEx
API String ID: 2568140703-325266469
Opcode ID: 8df1bd1a078dceb3bb9a8c9e72dfba4d742f2788511e26483a5dcb4ccb503275
Instruction ID: 07eba4f084978ac905354dad0a7698242192343c03f1c99d4b70f2b76ecc3e4c
Opcode Fuzzy Hash: 8df1bd1a078dceb3bb9a8c9e72dfba4d742f2788511e26483a5dcb4ccb503275
Instruction Fuzzy Hash: 9901D73254110DBBCF02AF90DD05EEE7F62FF48760F154129FE1466161CB768931AB95

Function 003D5160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,003D1104,?,?,00000000), ref: 003D517F
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,003D1104,?,?,00000000), ref: 003D51AF

Strings

burn.clean.room, xrefs: 003D516C, 003D5179, 003D51A6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: ccb41db07c0f54d66973e564de25282a815e2a1b7730955dddb7772d4b88404f
Instruction ID: fc94de7f4e138da5ea053b59ca443ba9358af9a33df58a7b13d3ed910381bd3d
Opcode Fuzzy Hash: ccb41db07c0f54d66973e564de25282a815e2a1b7730955dddb7772d4b88404f
Instruction Fuzzy Hash: C101F473650A206B8B215B48BE85EB3FBACEB1C764B114127F945C3710C365ACB0CBA6

Function 00413448 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00410823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,0043AA7C,00000000,?,00414FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00410837

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,004132E8,?), ref: 004134B9

Strings

EnableLUA, xrefs: 0041348B
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00413463

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: cd8c89e927e705223c0c44d8a181bf0a70f9c0d043e2a90395ace7997df4694d
Instruction ID: 139eebc996d8d949854cfdc2a9c4f7256d204741d5cad23dbf29c2a797f5fb88
Opcode Fuzzy Hash: cd8c89e927e705223c0c44d8a181bf0a70f9c0d043e2a90395ace7997df4694d
Instruction Fuzzy Hash: 30018432C51128FBD711AEA4CD06BDEF6689B04726F2041A6E901B7150D3BC5F84D7DC

Function 0040B62A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00408064: EnterCriticalSection.KERNEL32(?,?,0040442A,00000000), ref: 00408073

DeleteCriticalSection.KERNEL32(?,00437B30,00000010,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0040B68C
_free.LIBCMT ref: 0040B69A

Strings

G(, xrefs: 0040B654, 0040B66A, 0040B680, 0040B692, 0040B6A0

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CriticalSection$DeleteEnter_free
String ID: G(
API String ID: 1836352639-1857873316
Opcode ID: dfa90c20e3a064feb88066327d2cea4b242e9a57d74dfebdb01fadb112e9c532
Instruction ID: fbdd26bf512590a88c2be63994fef5456dbbdde2458e66ccb894dca9267b93b4
Opcode Fuzzy Hash: dfa90c20e3a064feb88066327d2cea4b242e9a57d74dfebdb01fadb112e9c532
Instruction Fuzzy Hash: 41116131510624DFDB21DF98D886B6D73B0EF04724F10552AE691AB2F1CB39E851DB8D

Function 004160FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00416160

Strings

`<u, xrefs: 00416160
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 0041611C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: FreeString
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 3341692771-3052637621
Opcode ID: fca03a5769ca091bb6ee5a80fc1981ae673e732ac9c6c742145f87745c245970
Instruction ID: b83a5f83bb27de1732a894bd24ca37df89761ad500acf61c2d003e8b3cc80795
Opcode Fuzzy Hash: fca03a5769ca091bb6ee5a80fc1981ae673e732ac9c6c742145f87745c245970
Instruction Fuzzy Hash: D101D132800115FACB225A459D02BEFFB799F41B60F22411BB80076352D3BCCE80A6A9

Function 003D34C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,003D10DD,?,00000000), ref: 003D34E5
GetLastError.KERNEL32(?,?,?,?,003D10DD,?,00000000), ref: 003D34FC

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 003D3520

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-4168559387
Opcode ID: f72cab47381fd03aa252111b6a2e3eda55e29eb9245366cb471df8441466531e
Instruction ID: fd807eff5f005ecf8158c98dd931beb912c1693e87387516673716ebc77ff774
Opcode Fuzzy Hash: f72cab47381fd03aa252111b6a2e3eda55e29eb9245366cb471df8441466531e
Instruction Fuzzy Hash: EAF0C273A415317787335696BC09E9BBB6DAB42BA0B174123FD04AF301D669DE0082E2

Function 003D6540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 003D6552

Part of subcall function 0041038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,003D5EE0,00000000), ref: 0041039E
Part of subcall function 0041038A: GetProcAddress.KERNEL32(00000000), ref: 004103A5
Part of subcall function 0041038A: GetLastError.KERNEL32(?,?,?,003D5EE0,00000000), ref: 004103BC

Part of subcall function 003D5D14: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 003D5D9A

Strings

Failed to get 64-bit folder., xrefs: 003D6575
Failed to set variant value., xrefs: 003D658F

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 5110dd7a309c4eff888914fe2eb639ca765628cdc4291d0f069f491c3a0d4f1a
Instruction ID: bea944d51905043075828627b3c2fd48d54678553128100ccee8be7315fe21fd
Opcode Fuzzy Hash: 5110dd7a309c4eff888914fe2eb639ca765628cdc4291d0f069f491c3a0d4f1a
Instruction Fuzzy Hash: DB016273940628FBCF13A7A0EC06ADE7A79EF05721F204167B80066255D775AF80DA94

Function 003FDFDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 003FE902

Part of subcall function 00400AD1: RaiseException.KERNEL32(?,?,?,$?,?,00000000,00000000,?,?,?,?,?,003FE924,?,004378A8), ref: 00400B31

__CxxThrowException@8.LIBVCRUNTIME ref: 003FE91F

Strings

Unknown exception, xrefs: 003FE92C

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 7d439b3075ec71194334ef6a36a529aa1617f8b67deb92fb9610be66a87c4378
Instruction ID: 5fd0b1b49eb4273c0869103f129bd4af4ac5c2411e93952814643171d117c89c
Opcode Fuzzy Hash: 7d439b3075ec71194334ef6a36a529aa1617f8b67deb92fb9610be66a87c4378
Instruction Fuzzy Hash: FCF04634A0430D77CB25BAB6DC0AA7D336C9E00750FA0463BFB18A54F1EBB8D916C598

Function 00414224 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,003DB9EC,?,?,?,00000000,00000000), ref: 0041423C
GetLastError.KERNEL32(?,?,?,003DB9EC,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00414246

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 0041426A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 464720113-1688708105
Opcode ID: 126370120a2d179e146d5f6b74b8ffd4c6dd5fc8a67c85a5766677b8cc6734d6
Instruction ID: 59e834a03713b2e474c42f03de7fac7fbae9bcc43f919d166a9aaa7ca48c6156
Opcode Fuzzy Hash: 126370120a2d179e146d5f6b74b8ffd4c6dd5fc8a67c85a5766677b8cc6734d6
Instruction Fuzzy Hash: A0F044B2901226AB97108B85C90599AFBACEF54760B128156BD54A7340D374AD50C7D9

Function 004135D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,003D54A3,?,00000000,003D54A3,?,?,?), ref: 004135FE
CoCreateInstance.OLE32(00000000,00000000,00000001,00436B4C,?), ref: 00413616

Strings

Microsoft.Update.AutoUpdate, xrefs: 004135F9

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: 284d945141332006d5874ed2f87d628f72f376b07ccd1019cb592e463990344d
Instruction ID: aed77af257cc67617c499869171eee2ff19f5a3ff05d1363aa13c184f96c344d
Opcode Fuzzy Hash: 284d945141332006d5874ed2f87d628f72f376b07ccd1019cb592e463990344d
Instruction Fuzzy Hash: 3EF05471600109BBDB00DFA8DD46AEFB7B8DB48710F514036EA01E7151D674AE048666

Function 00408335 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00406F11), ref: 00408380

Strings

InitializeCriticalSectionEx, xrefs: 00408346, 00408350
8?, xrefs: 00408370

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 8?$InitializeCriticalSectionEx
API String ID: 2593887523-891193350
Opcode ID: 0a2d7cad4ffd83b8978d79893d3b861cc306b0177c07fadfaec2f7d77bdd289e
Instruction ID: b7445693efe10287981649e74e5e2cb0aad2ca8c6e024c20f3dee5efaa1b2ee9
Opcode Fuzzy Hash: 0a2d7cad4ffd83b8978d79893d3b861cc306b0177c07fadfaec2f7d77bdd289e
Instruction Fuzzy Hash: A1F0B431A4221CBBCB11AF51CD05EAE7F61EF48761F10416AFD062A260CB764A20AA89

Function 004081DA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00408219

Strings

8?, xrefs: 0040820F
FlsAlloc, xrefs: 004081EB, 004081F5

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Alloc
String ID: 8?$FlsAlloc
API String ID: 2773662609-1501505578
Opcode ID: 968886e84510b2433b7a7d8afeb8c5f333bac2a2ad9027a8cc5e288151c5dd74
Instruction ID: b02d0cb37fd2e52359903efa9b8dc601100a62d9f9076cf921460f63cf2636e1
Opcode Fuzzy Hash: 968886e84510b2433b7a7d8afeb8c5f333bac2a2ad9027a8cc5e288151c5dd74
Instruction Fuzzy Hash: E1E05532AC12087BC700AB608C12B6EBB54DF68721F2102BEFC0567290CE780D20C5CE

Function 00408230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

TlsFree.KERNEL32(?), ref: 0040826F

Strings

8?, xrefs: 00408265
FlsFree, xrefs: 00408241, 0040824B

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: Free
String ID: 8?$FlsFree
API String ID: 3978063606-2030545325
Opcode ID: d367a91ef54586a8a01f40531da6dc49daf36be855445ff0f5241bb2c7ab2ee3
Instruction ID: 2ac2122b37d96ebd923a5a55e88f75d78c2787dc1c6c42cb676046909cbb9a6b
Opcode Fuzzy Hash: d367a91ef54586a8a01f40531da6dc49daf36be855445ff0f5241bb2c7ab2ee3
Instruction Fuzzy Hash: D9E0E531B421187BC600BF619D06E7EBB55DF09B12F1141BFBD0567290CE340D1086CE

Function 00412CB1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 00412AB1: SysAllocString.OLEAUT32(0041A4E8), ref: 00412AC4
Part of subcall function 00412AB1: VariantInit.OLEAUT32(?), ref: 00412AD0
Part of subcall function 00412AB1: VariantClear.OLEAUT32(?), ref: 00412B44
Part of subcall function 00412AB1: SysFreeString.OLEAUT32(00000000), ref: 00412B4F

SysFreeString.OLEAUT32(00000000), ref: 00412CEF

Strings

`<u, xrefs: 00412CEF
msasn1.dll, xrefs: 00412CBC

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: String$FreeVariant$AllocClearInit
String ID: `<u$msasn1.dll
API String ID: 3379191133-267575571
Opcode ID: 238948899f98de4df607c33fe784889aa1af3ef9763f81303085f5ff6fe989b9
Instruction ID: 6c92771e247f772954a056dacfc5076bce963a7fd438611a229ec1ae6ed97d2b
Opcode Fuzzy Hash: 238948899f98de4df607c33fe784889aa1af3ef9763f81303085f5ff6fe989b9
Instruction Fuzzy Hash: F7F08231500108FBCF119F55CE05BDE7B75FF84354F204029FA01A6260E7B59E60EB58

Function 00406E42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 0040B62A: DeleteCriticalSection.KERNEL32(?,00437B30,00000010,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0040B68C
Part of subcall function 0040B62A: _free.LIBCMT ref: 0040B69A

Part of subcall function 0040B858: _free.LIBCMT ref: 0040B87A

DeleteCriticalSection.KERNEL32(002847C0), ref: 00406E6B
_free.LIBCMT ref: 00406E7F

Strings

G(, xrefs: 00406E51, 00406E5E, 00406E84

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: _free$CriticalDeleteSection
String ID: G(
API String ID: 1906768660-1857873316
Opcode ID: 7e99fdd5f2941c45ef744a0c22838199fd2c2c0ff77c675040c0a2da3c1cbd40
Instruction ID: a5ab131072f34622020f4b1d5a9e10d65c893facc736b6e9b06d5e4c7c0d196d
Opcode Fuzzy Hash: 7e99fdd5f2941c45ef744a0c22838199fd2c2c0ff77c675040c0a2da3c1cbd40
Instruction Fuzzy Hash: 79E04F32804A209BDA21B799FC85B5A33B4EB99354B01143AFA05A31A1CB39AC509ACD

Function 00400F0C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00400F21

Strings

8?, xrefs: 00400F34
FlsAlloc, xrefs: 00400F10, 00400F1A

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: try_get_function
String ID: 8?$FlsAlloc
API String ID: 2742660187-1501505578
Opcode ID: 0405e2b94cb1ab81f8c2d825323bc9fc8169285b0b432254a5e0cd852b2d646c
Instruction ID: c49ebf2160e22ccc144230c9b0f62102c12606bd6dd427483b9608de854f8924
Opcode Fuzzy Hash: 0405e2b94cb1ab81f8c2d825323bc9fc8169285b0b432254a5e0cd852b2d646c
Instruction Fuzzy Hash: D3D02B3178523873C2103780BC16BE9BB04D710BB6F148273FF0C71282C5B9092082CE

Function 004106C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 004106E1

Strings

RegDeleteKeyExW, xrefs: 004106D6
AdvApi32.dll, xrefs: 004106C6

Memory Dump Source

Source File: 00000004.00000002.2925367440.00000000003D1000.00000020.00000001.01000000.00000009.sdmp, Offset: 003D0000, based on PE: true

Associated: 00000004.00000002.2925288288.00000000003D0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925480144.000000000041A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925591321.000000000043A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.000000000043D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000447000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000004.00000002.2925680188.0000000000456000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_3d0000_setup.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: ccc6ae59e9c0af8ae0443e1ba427c7405a982d6300af0d50cf59aebffe689036
Instruction ID: 25064289da3ead0716b700de8c7cf4a94e0e3c8123dd869eaf0d98a6e5dd52d9
Opcode Fuzzy Hash: ccc6ae59e9c0af8ae0443e1ba427c7405a982d6300af0d50cf59aebffe689036
Instruction Fuzzy Hash: 9AE0C2706027219BD3016F54BC477893E50FB08B24F103132E6059A272C7B94CC99BCE

Analysis Process: setup.exePID: 6016, Parent PID: 732COMMON

Executed Functions

Function 063D0D90 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d795a3fc58328e4f50fd086f70067bd6607a25366810166995e7801f17a86374
Instruction ID: d10b308f590f03afd8c4f2a58bc44ad086f26fbc7b875fd0be249559184960c0
Opcode Fuzzy Hash: d795a3fc58328e4f50fd086f70067bd6607a25366810166995e7801f17a86374
Instruction Fuzzy Hash: BA121A74A002289FCB94DF28D998A99B7F6EF89300F1085D9D54AAB355DF349E81CF81

Function 063DC768 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43b1d7315fda35745ef6b6bd1bad1aeb7d70686b4ab63a2f68162ff263764904
Instruction ID: eb407e60b6dbb35f1011662b8390d0ddeef7ff9a2bb9cc6f41a9c0fd5bdd96b4
Opcode Fuzzy Hash: 43b1d7315fda35745ef6b6bd1bad1aeb7d70686b4ab63a2f68162ff263764904
Instruction Fuzzy Hash: 91C19C72E241298FCB45CBA8D9806ADFBF6FF88300F14862AD455EB245D774AD46CBD0

Function 063D6A50 Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a78625709d4b338424d4262ad32d60368eb80a89a41a94b56b66547a09a39b
Instruction ID: d64def144ddd1b89d32850b2d252c8938b6878d1005ce1b6ecd56018fa0bd360
Opcode Fuzzy Hash: 64a78625709d4b338424d4262ad32d60368eb80a89a41a94b56b66547a09a39b
Instruction Fuzzy Hash: 86B19F75A001149FE744EB68E8996AAB7B7FF89300F14C125E5069B398DF349C86CBD2

Function 063D6A41 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f26b2b3752171333638083f4c50f855b5a8cb2e0bd753d1069392645df7dc45
Instruction ID: af8da1b76f69624cadd2b581df8d3560c403ca7277acf471d717fbc5b6c84926
Opcode Fuzzy Hash: 8f26b2b3752171333638083f4c50f855b5a8cb2e0bd753d1069392645df7dc45
Instruction Fuzzy Hash: 66B1AF75A001149FD744EB68E8A97AAB7B7FF89300F14C125E5069B398DF349C45CBD2

Function 063D0040 Relevance: 3.3, Strings: 2, Instructions: 794COMMON

Download Yara Rule

Strings

2, xrefs: 063D0887
$^q, xrefs: 063D0385

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: 2$$^q
API String ID: 0-1071376767
Opcode ID: 05c12204bf5a5851bee28690642851e4c58514665093b8da01685e62f2813275
Instruction ID: 2e16332bad3a7aad541c3e2228c04e949c56a98433d9fe5865f27109674a2ec4
Opcode Fuzzy Hash: 05c12204bf5a5851bee28690642851e4c58514665093b8da01685e62f2813275
Instruction Fuzzy Hash: 8C722A74A003248FDB94DF68D98869ABBF3FB89740F1084AAD50AD7394DB349D85CF91

Function 063DDDB2 Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

g, xrefs: 063DDDE7
4'^q, xrefs: 063DDE1E

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: 4'^q$g
API String ID: 0-4188448741
Opcode ID: 2be0a4b353c6e10c9888e18edce2e5d97f9ed40ce29ee3f0720ceb18f4c68097
Instruction ID: 7284593f60404b4da89c8f86b3c057dd4b64b371d5c34bd256b209ec22cf0891
Opcode Fuzzy Hash: 2be0a4b353c6e10c9888e18edce2e5d97f9ed40ce29ee3f0720ceb18f4c68097
Instruction Fuzzy Hash: 7251CD75600200CFD790EF28E49876BB7A7EF94300F148969D5069F799CB74AD49CBE2

Function 063DDDC0 Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

g, xrefs: 063DDDE7
4'^q, xrefs: 063DDE1E

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: 4'^q$g
API String ID: 0-4188448741
Opcode ID: 1e1c70a8d24ac39b364b099e41c678f81750d70caa1914f178b985ab14767a9f
Instruction ID: e4889b0cbd066cf1a12d1edb56eb8499046352833bc1a6c24908d78cb2d8e017
Opcode Fuzzy Hash: 1e1c70a8d24ac39b364b099e41c678f81750d70caa1914f178b985ab14767a9f
Instruction Fuzzy Hash: D1519C75600200CFD790EF28E48876BB7A7EF94300F14C969D50A9B799CB75AD49CBE2

Function 063D6F10 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

Deq, xrefs: 063D6FA5

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: c93dc622c983c2a3ec1fe55b4b5a28e82197df9bd3bb8a9025b3d632a218659c
Instruction ID: a91ec4a4bca0e187e397fc80d3f322b9b420191c3da793a7274d41e3d80fa5ce
Opcode Fuzzy Hash: c93dc622c983c2a3ec1fe55b4b5a28e82197df9bd3bb8a9025b3d632a218659c
Instruction Fuzzy Hash: 09A1B075A002149FC754EF29D894A5EBBF2FF89310F1585A9E405DB3A1DB31EC02CBA1

Function 063DD240 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

4c^q, xrefs: 063DD42E

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: 14e3eeb698ee83ced6dd77745c066748d778c52d37445e8ce9a25fefe9be510d
Instruction ID: 783d4736a39e39c6518b14453ea95ec0b5c4232051f70a88d27feea2ff36ff09
Opcode Fuzzy Hash: 14e3eeb698ee83ced6dd77745c066748d778c52d37445e8ce9a25fefe9be510d
Instruction Fuzzy Hash: 65618B78A002149FD794EB6DE45876AB6F7FFC8310F148069D5069B398CB389C46CBE2

Function 063DD250 Relevance: 1.4, Strings: 1, Instructions: 175COMMON

Download Yara Rule

Strings

4c^q, xrefs: 063DD42E

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: e6468acaeb1580e61ca2e87af3023b1d8be26112fe092dca1374bd410b099b24
Instruction ID: a40af61328c4659376c1e4b91d695e1b1c08af83be3e59c1dc42bb3ccff5beb5
Opcode Fuzzy Hash: e6468acaeb1580e61ca2e87af3023b1d8be26112fe092dca1374bd410b099b24
Instruction Fuzzy Hash: FE618B78B002149FD784EB6DE45876BB6F7EBC8310F148069D5069B398CB789D46CBE2

Function 063D6F02 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

Deq, xrefs: 063D6FA5

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: Deq
API String ID: 0-948982800
Opcode ID: 408fa917bd622132ad3679e2b89a3ffeebba052c8dc47d6d0633c39c70159b04
Instruction ID: 669d0b3b87af1dd6f312523638220eba6e28184e2ffcb59c2323c74995b932dd
Opcode Fuzzy Hash: 408fa917bd622132ad3679e2b89a3ffeebba052c8dc47d6d0633c39c70159b04
Instruction Fuzzy Hash: 9761AD75A006108FC754EF29E894A59BBF2FF88310B1585A9E456EB3B1DB31EC41CFA0

Function 063D2346 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

TJcq, xrefs: 063D236D

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID: TJcq
API String ID: 0-1911830065
Opcode ID: 849bb0b291b00353e085b52704b7605763f479759e6c794c9cd357fa56ade1ed
Instruction ID: fd07c79dccb63ab6b856b906e1fc6ef38be1708937b859ea7773bbb216278c14
Opcode Fuzzy Hash: 849bb0b291b00353e085b52704b7605763f479759e6c794c9cd357fa56ade1ed
Instruction Fuzzy Hash: CB41D4397041205FE795AB68E85876B72E7EBC8750F144069DE07DB3C4CE349D4A87D2

Function 063DCB58 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f9112fa04fbe1be66a9756453be3deb271856a9303d1b92543481c89156524
Instruction ID: 0e14b9913b5217fcd639260378d5348063c7fbfd1472b51fdf9587b151b5eed4
Opcode Fuzzy Hash: 11f9112fa04fbe1be66a9756453be3deb271856a9303d1b92543481c89156524
Instruction Fuzzy Hash: 6E51E9B2A20204CFD7A4DB19E49476AB7EBFBC4300F149426E5069B784CB349C86CBD1

Function 063DEF90 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4eb100c054d2ded9d6056ae1dd6a0f3bcf4f22189f3013563e68f578ed41b0
Instruction ID: 50a01d87acfab978106e36aff44633f9ed265a3472a13b2a17b51edc28066fe8
Opcode Fuzzy Hash: cf4eb100c054d2ded9d6056ae1dd6a0f3bcf4f22189f3013563e68f578ed41b0
Instruction Fuzzy Hash: 53415B367093449FC351D768FC94AA77FABEB86314F0880AEE106CB692CA355C05C7E2

Function 063DAD80 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 722a6e99029071e125907551c740faa1027a851a7960e9e925f2b4dfebc71fa3
Instruction ID: 63ac2b7147be141c43ab8e753b15bd2e64c6f742662a3c48d836f7bc95cbd917
Opcode Fuzzy Hash: 722a6e99029071e125907551c740faa1027a851a7960e9e925f2b4dfebc71fa3
Instruction Fuzzy Hash: EC41B073F082218FEBD05A65FB9023AB3EEAF84242B050879D91BD7640EB34CC4887D1

Function 063D9270 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e95d09ed9acb8c91a01a9d6b437d5ef539fabccbd3fa0b74ddbfb6df329d92
Instruction ID: 9d85dd974538ad6ee995d42c02140af87b41dcce86eec3555eb95e55522ed484
Opcode Fuzzy Hash: 55e95d09ed9acb8c91a01a9d6b437d5ef539fabccbd3fa0b74ddbfb6df329d92
Instruction Fuzzy Hash: A041CF33B141748BDBE01A26B91473A77EAAFC5B55B094055E94BCB6C0EB30CC45C7D1

Function 063DAD70 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7edfecc2bd2561a5ba701001b59315bc720214ecfe555e18a0710dad0229add6
Instruction ID: d049c9099292108aea6e2fad126f4153d7212d12f0cbfb52a4d14c3f55378163
Opcode Fuzzy Hash: 7edfecc2bd2561a5ba701001b59315bc720214ecfe555e18a0710dad0229add6
Instruction Fuzzy Hash: D1419C73A08221CFEBA14B21EB9067AB7FEAF80242B050879D85BC7551E734D849CBD1

Function 063D6418 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd157738a6a7da8bb5830241621ebb28556fdd3ad525b0d756bffb98c2631cfa
Instruction ID: e15d434add89a87a9fcb42227122aa3f4dc82640d0632aa5da3b68b195fe9239
Opcode Fuzzy Hash: bd157738a6a7da8bb5830241621ebb28556fdd3ad525b0d756bffb98c2631cfa
Instruction Fuzzy Hash: 02412032A04244DFDB91CB64E8167AA7BF7FB86300F1444AAD0519724AD7369D85CBE1

Function 063D4E28 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efc4245db08ce2bbbfb63774323b18a12994f5f7eec80a7453b6c56870807bd9
Instruction ID: 8d10e8749aa9afcc625a0b3d28909fc3b63e383e576818e2e01c62baf0da0f0c
Opcode Fuzzy Hash: efc4245db08ce2bbbfb63774323b18a12994f5f7eec80a7453b6c56870807bd9
Instruction Fuzzy Hash: 17313833B042309FDBA19B79B85862DB7EBAFC5251715547AD60BD7242EF308C4687C1

Function 063D9260 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1f41bd3f1991bdcc2d0d298ace9258f42009cc4eca36293a0db8a61ad81f3c8
Instruction ID: cdb7bd916912b34c3a9ac8e15be20c7d8370b8cfb1ca263085c28064fa7a6c06
Opcode Fuzzy Hash: a1f41bd3f1991bdcc2d0d298ace9258f42009cc4eca36293a0db8a61ad81f3c8
Instruction Fuzzy Hash: C531C333B081A4CFDBE10F25BC147797BAAAF85759B094096E94B8B6C4D730C945CBD1

Function 063DDE48 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96a050ca3cecb169d253b9b29723b32fd29724a76449dc2c3c7e2422311adb49
Instruction ID: 930f83affc1521cba3d2cdb9af78f3d2a4387dee134986687b7e8f390f068c3f
Opcode Fuzzy Hash: 96a050ca3cecb169d253b9b29723b32fd29724a76449dc2c3c7e2422311adb49
Instruction Fuzzy Hash: 05319079600100CFD780DF68E48876AB3A7EFD4311F14C566D5069B799CB35AD4ACBE1

Function 063DE420 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2810fa87a507307ef7d83d2f17411c4fccf9e3e1a10399a59a8a936a7b55ba8c
Instruction ID: 7929003e0cb74e42cd527094aadfdf51e8946d55edd55771a5017b4455b44b0f
Opcode Fuzzy Hash: 2810fa87a507307ef7d83d2f17411c4fccf9e3e1a10399a59a8a936a7b55ba8c
Instruction Fuzzy Hash: AA214C257093845FC3529778A8299AA7FB6DF87254F1940DBE541CF2E2DE394C06C3E2

Function 063D2ACE Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd9bf4388a2ca4cebeae8883a836ef14941863e5ce815605031ad4e31524022
Instruction ID: ad4d8fb103061d78043eb25763c4f0b7187ab159194f26e5025aab799917ef63
Opcode Fuzzy Hash: 3bd9bf4388a2ca4cebeae8883a836ef14941863e5ce815605031ad4e31524022
Instruction Fuzzy Hash: 5F316F32E00621CBEF80DF14E44426BB3E6EF48750F558465DA16F7684DB38EE459BE1

Function 02AEEBC0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928917527.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2aed000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8bc8db767e9dcac62ec4f3a328746d551da13d02fd5ae63cd883224a7af724
Instruction ID: 1e49988e6e47d6604e3785eaeebef998e703d014bdad41d3de6cdd34fc591f58
Opcode Fuzzy Hash: 3d8bc8db767e9dcac62ec4f3a328746d551da13d02fd5ae63cd883224a7af724
Instruction Fuzzy Hash: C931E672504240EFDF069F54CAC4F16BF76FB88324F24C699E90A0A256C736D866DBA1

Function 02AEEAC4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928917527.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2aed000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b5e478f3d6ed6d4d8a71090af8e78420312939f2020629edb16d4940aa394
Instruction ID: d0bf5efbfa1f5ce7761be8ee19d9a668f0a9cabac44ca1198351ffbf5b2e0979
Opcode Fuzzy Hash: 201b5e478f3d6ed6d4d8a71090af8e78420312939f2020629edb16d4940aa394
Instruction Fuzzy Hash: 6521D6B2504240EFDF059F54DAC4F16BFA5FB88324F24C699EA0B0A256C736D457CB61

Function 063D4E17 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d265320401c4fe68dcf633857ca0e9081b646e76f4afc9fca728f1ae115fb16
Instruction ID: ca696cf51769c6863d46b81ed5b7e4a2691a8f7b1a161fe694f79dc66771e103
Opcode Fuzzy Hash: 5d265320401c4fe68dcf633857ca0e9081b646e76f4afc9fca728f1ae115fb16
Instruction Fuzzy Hash: 50213433B082719FDB62CB39B444169FBEAAFC526170951AAE14AC7242E7308C46C7C0

Function 0280D760 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928077653.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_280d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73119ac9a95b4f838b44c19d85fda9345dd6b8413014894ee42f61364a860f2
Instruction ID: 34ecab5c47be456c8efc2f651f20367281728c79039e9a038daa97451ccbcd0b
Opcode Fuzzy Hash: b73119ac9a95b4f838b44c19d85fda9345dd6b8413014894ee42f61364a860f2
Instruction Fuzzy Hash: 9E21387A500244DFDB45DF54DDC0B26BFA5FB88714F24CA69E90D8B285C336D416CBA1

Function 02AED060 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928917527.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2aed000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66adfae991fb6c18539b5b66226b4853638b20a217e29afae4553b28e40455ce
Instruction ID: 25f0d89b13cbe62c81849c432e50e9051c4fa1ed66939776a8f29d2cd14ce34d
Opcode Fuzzy Hash: 66adfae991fb6c18539b5b66226b4853638b20a217e29afae4553b28e40455ce
Instruction Fuzzy Hash: C821D0B5604600EFDF14DF14D9C4B26BBA9EB88314F24C66DD80B4B246CB3AD84BCB61

Function 063DDFE0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e0485090fb99c284f14189ecc7c15154ef2b3db39574cea1796441e71c28fb5
Instruction ID: 12f6ab41935afa5635267e81abe2883b92f181e45017bfe771f26911a19faee2
Opcode Fuzzy Hash: 0e0485090fb99c284f14189ecc7c15154ef2b3db39574cea1796441e71c28fb5
Instruction Fuzzy Hash: A921DE79A05208CFCB909F59E4087AE7FB6FB44341F004066D00A8F341CB38A94ACBE2

Function 02AEEBBB Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928917527.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2aed000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac90ea518135cca0349e4c08ba6bf8b8fc45b5f0503c7ce608b39aed0cff197
Instruction ID: 27e3fef8164a3f64a6d282cd618c81dec1101e634e3401b107d444d175dbc6c0
Opcode Fuzzy Hash: 1ac90ea518135cca0349e4c08ba6bf8b8fc45b5f0503c7ce608b39aed0cff197
Instruction Fuzzy Hash: BF21B076500280DFCF46CF50CAC4B55BF72FB88324F248299ED0A0A22AC336D466DB91

Function 063D2DA0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4c42f3869c1abacca1590214e6cc77f5e546b728282ac4c267a53c5b96fcd4
Instruction ID: 613a8fe413957ca13a69942d4089109a4064ab2936c2ed09c4207ab7bcddb045
Opcode Fuzzy Hash: 9a4c42f3869c1abacca1590214e6cc77f5e546b728282ac4c267a53c5b96fcd4
Instruction Fuzzy Hash: 1A01D62A45F184AECF318B34AC69EDB3F7CDE56145B580993F2C3E2812C1289656C6F3

Function 02AEEABF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928917527.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2aed000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fefa44d6fc6d4ef6f23875e2bff54eea8abd97bf79ee55c68f64f178995d3fe
Instruction ID: 43fa4058fc5f3d6cbadcc29d47bd8f83be6b70ab80c2374316bca94430d0f0f5
Opcode Fuzzy Hash: 0fefa44d6fc6d4ef6f23875e2bff54eea8abd97bf79ee55c68f64f178995d3fe
Instruction Fuzzy Hash: D7218E76504240DFCF06CF54DAC4B56BFB2FB88324F24C299DE0A0A65AC336D466DB91

Function 0280D75B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928077653.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_280d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76b8804152db2cc6a01fe161c1ad6b4fd6228a2fa6860865e401e05a6fca028
Instruction ID: e46db6379d1827d8d63124917c4f2a6ed76c8eabdaeae4d7747806395a62075b
Opcode Fuzzy Hash: c76b8804152db2cc6a01fe161c1ad6b4fd6228a2fa6860865e401e05a6fca028
Instruction Fuzzy Hash: 4E21CD7A504280DFCB06CF40D9C4B16BF72FB88724F28C6A9D9494A256C33AD426CBA1

Function 02AED05B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928917527.0000000002AED000.00000040.00000800.00020000.00000000.sdmp, Offset: 02AED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2aed000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c33b36da5aaa7148570fa1371d1392c11b2121a1b4879d0ee1e27dbd036603
Instruction ID: 39ffe110b24c8606e5a68a479a227eefe929374cad10cbf16ce92d92ece48247
Opcode Fuzzy Hash: 06c33b36da5aaa7148570fa1371d1392c11b2121a1b4879d0ee1e27dbd036603
Instruction Fuzzy Hash: 0C11D075544640CFDB01CF14D9C4B15BB71FB48314F24C6ADD84A4B656C33AD84BCB61

Function 063DEB10 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c01f02dfc2ddc2c2fd2016b9e1a97de7c49a6deae042b2330800541ffc8be8e9
Instruction ID: 287b8247660fe10f8bc224d46a5567201de8feef81250c356acdda126ada33c1
Opcode Fuzzy Hash: c01f02dfc2ddc2c2fd2016b9e1a97de7c49a6deae042b2330800541ffc8be8e9
Instruction Fuzzy Hash: DA01B53540E3C8AFC7529BB49C15986BFB99E4710031544DBD099CF163D9319915CBF2

Function 063DD7FF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edbc5e74950a207241ccf585ba15d3e64af570524a33f53058c9878df2f276a
Instruction ID: 21c524ce9c9e49dfd038beb1d968cd1acdbb0f7ff6a95abded8030d92b426e5d
Opcode Fuzzy Hash: 3edbc5e74950a207241ccf585ba15d3e64af570524a33f53058c9878df2f276a
Instruction Fuzzy Hash: 85014E35A092086FD756DFF0EC01D59BBAADFC2210F0046D9E429DB252DE729D11C3D1

Function 063DE410 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e8385db04988c4110f77dc985ff8ea06a83e746475f01e598b1272dc34af77
Instruction ID: 6e8128fc8d3d21acb02999d60d8f17180b85fa76ea5b1abddd1b0a8b34221b18
Opcode Fuzzy Hash: 07e8385db04988c4110f77dc985ff8ea06a83e746475f01e598b1272dc34af77
Instruction Fuzzy Hash: 3401D63D7001105BC295A768E859ABF7BEBDBC9350F15806AE50ACF390CE399C0687E2

Function 0280D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928077653.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_280d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25257ace8b6efa3f9ea6a10cf3b92d810c5183019151f3f2361f104ad2a90c4
Instruction ID: bd4249031ec8ace2493c44fc9454bcd7296a168fa76e738d887bb8d860f62cfe
Opcode Fuzzy Hash: f25257ace8b6efa3f9ea6a10cf3b92d810c5183019151f3f2361f104ad2a90c4
Instruction Fuzzy Hash: 0B01F2795093449AE7608EA9CCC4F66BFD8DF51329F08C41AEC5C8B2C2C7799841CBB1

Function 0280D007 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2928077653.000000000280D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0280D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_280d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ee960e0f55bc1617831892627b8eb54720181aeb3b2f7d581b8a3daade7790
Instruction ID: be938711a7cdfff91a59dc82170fd1a55cbec297e45769595218d4485b40cffe
Opcode Fuzzy Hash: 72ee960e0f55bc1617831892627b8eb54720181aeb3b2f7d581b8a3daade7790
Instruction Fuzzy Hash: CD014C7540E3C09EE7128B258C94B52BFB4DF53224F19C0DBD8888F2E7C2699849C772

Function 063DD7A1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6144fc24449ab5a962be9e90ca322a1afbefd2a2eecaa562f253e9cdc032e5e2
Instruction ID: 907d69fc17a90c572ed98006d2812630f7510248d2db8a4ca34c4470cb6a0266
Opcode Fuzzy Hash: 6144fc24449ab5a962be9e90ca322a1afbefd2a2eecaa562f253e9cdc032e5e2
Instruction Fuzzy Hash: F0F09677E05208AFCB52DFE0E805DADBBBADF81300F0045D6D8199B221EA724A14D7D1

Function 063DEAA7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4709f44671ed9954627ce87d674689e0ded27b5446a1c91729e4bdcd221cc172
Instruction ID: 03657cc74e27fc5a5347c5be2d74305942922e4bd7bd0d28b5aee8d71e3d2d67
Opcode Fuzzy Hash: 4709f44671ed9954627ce87d674689e0ded27b5446a1c91729e4bdcd221cc172
Instruction Fuzzy Hash: A6F068316093846FC751DBB8DC1189ABFFA9F4A100B1548EFE4C8CB252D9318D12C7D6

Function 063D7250 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b4c1a158af0eadcf1d0c20840b385a85fc491971c3b5bd1530bb5f4edfc452
Instruction ID: 40b0a0c55fa237b41bc2e2cd420be03fbc666273f04d58174301a32969a17555
Opcode Fuzzy Hash: 44b4c1a158af0eadcf1d0c20840b385a85fc491971c3b5bd1530bb5f4edfc452
Instruction Fuzzy Hash: 25F0A7357553182BD308567E5C94B6B6ECFEBC9B51F1480AEA108CF286CD658C4553E2

Function 063D3BA0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d240159f5051c433df1aff28658bf4d170f1561bf607f4d3aebca584b971d0a2
Instruction ID: b807ec54fa9fa0f9ac6d382598120528ad32bc247b356275f41a8fde83b6ba5b
Opcode Fuzzy Hash: d240159f5051c433df1aff28658bf4d170f1561bf607f4d3aebca584b971d0a2
Instruction Fuzzy Hash: 1EF08933E049245BE7918F66B40475FF7AEDB85691F058075D91ED7280DA348D8587C2

Function 063DAFA1 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b407d19de65c2c40bab44d225d972fe371c4df176285b99d37420bad9ac6e368
Instruction ID: 6fdb162c99073a3065975470343c8656d109857be24e3efeb40d8443eb722ce3
Opcode Fuzzy Hash: b407d19de65c2c40bab44d225d972fe371c4df176285b99d37420bad9ac6e368
Instruction Fuzzy Hash: 66F0343608E3C49FC3235B38E8549947FB9AE47A0074A00D6E0C48B2B3D621EC49C7A2

Function 063D2DEA Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 365e2ac53c51e688a3c8338cd788b4d44bfe51af09dd3c8fe166271a5ce1b1be
Instruction ID: cd9c7baa5d430defa1ff2c8fd30828e90e831e3d203e44b0e6de55adc98a7316
Opcode Fuzzy Hash: 365e2ac53c51e688a3c8338cd788b4d44bfe51af09dd3c8fe166271a5ce1b1be
Instruction Fuzzy Hash: 87E0D82184F2D45FCB325B3058A86AB3F7DAD8708136806D3E1C3E7417C1140D56C3E2

Function 063DEA18 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da44bb62c3bd33f9cd1c152c04810ede48be2705cac174d025d0127be46d18fe
Instruction ID: f175ad4afa7fb8531c5015da0ac039c883980d301532242d6e8fcccbaff1bd16
Opcode Fuzzy Hash: da44bb62c3bd33f9cd1c152c04810ede48be2705cac174d025d0127be46d18fe
Instruction Fuzzy Hash: 09F0A7312093446FC741CB94DC018AABBFDAF8520471041DAA4489F252EE71DE11C7E6

Function 063D7260 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7434b01541d5afafadf65484964cecad16acc24ce14a692756aa3c960f20688
Instruction ID: eac34a63266fd57c8780ba780a75105ea493405584ec7873d83f415e0de76475
Opcode Fuzzy Hash: a7434b01541d5afafadf65484964cecad16acc24ce14a692756aa3c960f20688
Instruction Fuzzy Hash: 07E0D825B0022C27E30C267E1C94B6B99CFEBC9B51F14843EA10DCB380CD658C0103E1

Function 063DCDB0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fa574b5e2b309148cc93ff6b02dca36d4656a39aa3c9d9f8cc583deff81cb2
Instruction ID: 2ae87fc17dd9932df2e803a5fd992b3685d314f644dfeae4d4745b12c70e57ab
Opcode Fuzzy Hash: b1fa574b5e2b309148cc93ff6b02dca36d4656a39aa3c9d9f8cc583deff81cb2
Instruction Fuzzy Hash: CAE0D8B680538CBFCB129FF4AC118D97FBE9E461117100CE6E0C487112EA315A05C7E2

Function 063D6320 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2064b8c3610f0b9ceabedd85ec3ce4e92d8ca5b8c1858ef28b8635d38725affe
Instruction ID: 276f82c7c2afa440175e0c4f31b53e8ddade1e2e8879ad7ec636decfeafbcfbf
Opcode Fuzzy Hash: 2064b8c3610f0b9ceabedd85ec3ce4e92d8ca5b8c1858ef28b8635d38725affe
Instruction Fuzzy Hash: 65F06D75A051048FE3849B24F8597AA33A7FBC5304F488061D50B477A5CB796986CAE2

Function 063D25A0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f073a3dc105cb338172e1e53fee79db2628f435ef0effb5a35a19a4e54be2c
Instruction ID: d449e4ba55466562a4b7ba3a9f570674106bbdcddd90f74154442fc5c64f5d0f
Opcode Fuzzy Hash: 95f073a3dc105cb338172e1e53fee79db2628f435ef0effb5a35a19a4e54be2c
Instruction Fuzzy Hash: 22E04F7190924CAFCB11DFB0DD515CDBFF9DF06200B1508DAD48597212E9328A14A7D1

Function 063D1EAE Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f017ce34c695ffc4c60a2c9b2b9b6e710752194bfebc07b9acb334c346e294
Instruction ID: e52af0509739cb87c14684be4581ca1b409b6f4bce66d07e6f9afe35a6f6c2e1
Opcode Fuzzy Hash: 00f017ce34c695ffc4c60a2c9b2b9b6e710752194bfebc07b9acb334c346e294
Instruction Fuzzy Hash: 26F0E576A04218CFDB90CF84E984A9EF7B2FB94304F1080A6E205ABA25D3709A40CFD1

Function 063DDD48 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 464738dd6f4fbf82f2182c3943537908d6be9c4fda39bd75186c9ab52040a1eb
Instruction ID: c0c2eb971ae7353dc6473291095223308a8196cb36da3b2764195dc19772c2b6
Opcode Fuzzy Hash: 464738dd6f4fbf82f2182c3943537908d6be9c4fda39bd75186c9ab52040a1eb
Instruction Fuzzy Hash: 56E0DF31608380AFC3150B6CA818A963FAA9F87320F0A00ABE14587292CAB44C05D7E1

Function 063DD870 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c70870576b69d544c36c91b5eb8aab982d0057eb5392833c724c29e9c2e5dd85
Instruction ID: 800cf9528ab5a179dc0ad07e5a1bbb756c6be1585d859e7f84b17c1764d28206
Opcode Fuzzy Hash: c70870576b69d544c36c91b5eb8aab982d0057eb5392833c724c29e9c2e5dd85
Instruction Fuzzy Hash: F7F0AEB4E0420A9FCB45EFA8D445AAEBBF5EB48200F1080AAD919E7311E7359A51CF91

Function 063DFAF2 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74a5332c682700a809adcb8e5799a3c997f13eee6f7df8c76cc2baa4808ba2e6
Instruction ID: a64b5c635288d9cab91f32c6e6377b5ec2bcadbf8227c51a28dbd0f29ea31f04
Opcode Fuzzy Hash: 74a5332c682700a809adcb8e5799a3c997f13eee6f7df8c76cc2baa4808ba2e6
Instruction Fuzzy Hash: B8D012702493846FC302DB58DC51CA2BFA99F8611031480AAB888CB352E621AD12C6A1

Function 063DEF62 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2665ab48ac2cb43e5bf8a06a17106601f6634f4759c924371debadcfc3719c3
Instruction ID: 2d7027a56d6b25c73fdf9bde80735f8c2d8bdacffea0396aef1cc33c40c40347
Opcode Fuzzy Hash: c2665ab48ac2cb43e5bf8a06a17106601f6634f4759c924371debadcfc3719c3
Instruction Fuzzy Hash: 0BE0C2302483865FC305CB38CC61962BFA9EF8620471880EEE484C7653DA35AC22C354

Function 063DCDF1 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06b4ed8fc96d1509f7d76e52b55776ce57daade82715784e9667145d5adf75b
Instruction ID: 670efe5a8a2878492a9759db6fd49b594b8d07b8533fc848ca7df6caad9bd2b9
Opcode Fuzzy Hash: a06b4ed8fc96d1509f7d76e52b55776ce57daade82715784e9667145d5adf75b
Instruction Fuzzy Hash: 8CE0C2312082881FC711CB68CC10891BFB9CF8A504324889EE8C4C7203D521AC47C761

Function 063DEA82 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7877db940904675b29129bd1a9cf2aab76df074b027d3115ef1ac113abd89a
Instruction ID: 6aefa662143767045b1b78dbb954a99118c8509ffbe1692c2718c6433c8db1bb
Opcode Fuzzy Hash: ef7877db940904675b29129bd1a9cf2aab76df074b027d3115ef1ac113abd89a
Instruction Fuzzy Hash: DEE012302092445FC706DB69C851852BFB9DF55510314C09AE988CB257DA31AD52C7E5

Function 063DEAE8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8780c1140a3656cbdf1521350a2f7dd6e2ffb1ee9f4188a29804302f72b11edc
Instruction ID: 06ca69b60b34959d0bf7b4f4570d5609102886332bbc908884dfe6b6825a798b
Opcode Fuzzy Hash: 8780c1140a3656cbdf1521350a2f7dd6e2ffb1ee9f4188a29804302f72b11edc
Instruction Fuzzy Hash: 47E017303482845FC716CB28C8604A1FFB2DF9E10032888AFE8C8CB35AE6229C57C316

Function 063DCE20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3dac3eb25c271f3e68598c5a7827b0d1b760f9ecde915a5a5d304883553d66
Instruction ID: d0eee692da1b69a69e4ee12ba4c076e43f95d9b0af12e7dc1db765f4753ce995
Opcode Fuzzy Hash: 4f3dac3eb25c271f3e68598c5a7827b0d1b760f9ecde915a5a5d304883553d66
Instruction Fuzzy Hash: B4D0122104D7D94FC3134FF49E12150BFB98D071603AC04E6D5C682143C2651556CB56

Function 063D6428 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f83e3026b25d2ca0909ca040514d19996cf4dafa9779ca14faaa3c59605f0f07
Instruction ID: 67a6eb137bdc56bf168032c39783c07ff8494b577aac17df18bcc4bd9b7ecc95
Opcode Fuzzy Hash: f83e3026b25d2ca0909ca040514d19996cf4dafa9779ca14faaa3c59605f0f07
Instruction Fuzzy Hash: B7D0C972A0120CAB8B40EFF4ED0189EBBEDDF45610B1049E69509AB210EE329E10A7D1

Function 063D25B0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e34ff2992b43a1392171aa450a809f60108f08b70487d62a880172cdf5bcce5
Instruction ID: 723fed01183cadb6debbf236e53276dbd434d7c371e195e4d22b6b59a9c87379
Opcode Fuzzy Hash: 3e34ff2992b43a1392171aa450a809f60108f08b70487d62a880172cdf5bcce5
Instruction Fuzzy Hash: C7D0C9B2A0520CAB8B40EFF4E90199EBBEDDF45201B1149E69509A7210FE329A10A7D1

Function 063DEB20 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba15bbb524556bdb4118595bedb9bc975bdb443599fa11cb7152825942e407e3
Instruction ID: 20dadb2a4e6699a9880b919dc16c46d29206ecf6c2a83ee6c189e68923649504
Opcode Fuzzy Hash: ba15bbb524556bdb4118595bedb9bc975bdb443599fa11cb7152825942e407e3
Instruction Fuzzy Hash: 4ED0C972A0120CAB8B50EFF5E90699EBBEDDF46200B1049E69509A7210ED329A10A7D2

Function 063DBEF0 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52f57569d21512e31c7ea314c265a8e1edcb50986fd61525e2cb92114e15a05a
Instruction ID: 0382ea49102221d58c43c4346d805517a079b26fc88ea721731f2d85aad5508f
Opcode Fuzzy Hash: 52f57569d21512e31c7ea314c265a8e1edcb50986fd61525e2cb92114e15a05a
Instruction Fuzzy Hash: 1FD0C9341496C58FC717CB7C9854890BFB1AE1B51431945DFE1C8CBA67C3254856C721

Function 063D6EE2 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9c1eca72e283756b62ab56a4bf730125aac21733020bac844df52ac9b12f40
Instruction ID: 51d97a7096f36d0025e46394b2c316c23b6f6f1d7d1f8275b8ac3c2d02e5bddb
Opcode Fuzzy Hash: 3b9c1eca72e283756b62ab56a4bf730125aac21733020bac844df52ac9b12f40
Instruction Fuzzy Hash: 93C08C3604D3DC6FCB231FB828301D1BFBA6C0B00039914C2E1C887117D9214646C3BB

Function 063DCE00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Function 063D534F Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90343dfcbdccebcc14462e4631a4da0aedd9dfeb50e11bb74e703b138882b49a
Instruction ID: 7539ceac1f6b3d51a831d49521bd5cd7c496aad2b093a9a11d65fbee7d7e3b4b
Opcode Fuzzy Hash: 90343dfcbdccebcc14462e4631a4da0aedd9dfeb50e11bb74e703b138882b49a
Instruction Fuzzy Hash: BCB0923B709128CFA7495A84F4A40ADB336FAC01767208027E61B856848A22184286D5

Function 063D25F0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction ID: 6946c9798f7289baa91495e0fb5539b78174b0423724991b48b9fdfa7c9b4558
Opcode Fuzzy Hash: b07eb51126463de2bf8462432d69fd4c92e1a2acd6486d465ab4ae050f38ce89
Instruction Fuzzy Hash: 02B012302081084F8244D6D8E841C14F39DDBC4618354C0ADE80CCB302CF33FC0385C4

Function 063DBF00 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa260706c740860bcb45d9350555ad80cb8779cb0a989f23b559f03cddcc3d0
Instruction ID: 2e4309b843882d66e842a8bc1958411bf851f414d42e76a287317b216b9134f6
Opcode Fuzzy Hash: 6aa260706c740860bcb45d9350555ad80cb8779cb0a989f23b559f03cddcc3d0
Instruction Fuzzy Hash: 91B092341606088F82009B58D448C04B3E8AB08A2430140D0E1088B232C621F8008A40

Function 063DE3F0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f7341cf77aebb22b04d844155e4265ad70b896a8d0d786e418791b95a3e561b
Instruction ID: ee6cfe1fa563e42f6d240083718b8b9de4ca8f9f20ff51886216ec6fc37f7ea5
Opcode Fuzzy Hash: 0f7341cf77aebb22b04d844155e4265ad70b896a8d0d786e418791b95a3e561b
Instruction Fuzzy Hash: 8FC092B94493C1FFC72607F0AA9E0157F3A9A0622571900FBD889D5973D2380468D7E3

Function 063D2E30 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14eee542f98f69a20f1023a8619bdf92fde0ba85470bda46bd8a661cb158f49
Instruction ID: 740a937b724d6994bc6700cc358a424aaf264c534a1966e11465bf88a1f7fb91
Opcode Fuzzy Hash: a14eee542f98f69a20f1023a8619bdf92fde0ba85470bda46bd8a661cb158f49
Instruction Fuzzy Hash: 6190023104D75C8B464027967409655B75FA5449577C40061A60E415019AA6745045A5

Function 063D8740 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2934542924.00000000063D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 063D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_63d0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccb3b4f77165bc1bbcec4cd210275d28a541dd9ea8476df34373e7d4b516815
Instruction ID: d18d2995da6fdfeecbc1121166b578876282f6892954e425285553bedc6a2a83
Opcode Fuzzy Hash: 7ccb3b4f77165bc1bbcec4cd210275d28a541dd9ea8476df34373e7d4b516815
Instruction Fuzzy Hash: A7A00261918714CEF7909A199405755B6F59704340F1040AE6809D1540D3354A40DF93

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].htm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\installer[1].exe

C:\Users\user\AppData\Local\Temp\AdguardVPN\AdguardVPN_20240622002825.log

C:\Users\user\AppData\Local\Temp\adguard\setup.exe

C:\Windows\Temp\{7C63FFBB-C0A9-47C3-B13A-DFCD30F8028B}\.cr\setup.exe

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1028\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1029\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1030\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1031\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1032\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1035\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1036\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1038\mbapreq.wxl

C:\Windows\Temp\{99638758-BBFA-4C8F-9776-E2A24ED1D362}\.ba\1040\mbapreq.wxl

Windows Analysis Report
SecuriteInfo.com.TrojanPSW.Purelog.21832.24487.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre